Analysis
- max time kernel
142s - max time network
170s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe
- Size 7.1MB
- Sample260731-d2td1sca73
- SHA256 f257dbe80a0ede7af02c39a838931e501538d03a800f1408d30ee3ab88290dec
- MD5 129010160c5a269b8ab379b6995c4af7
- SHA1 faa1180ac0b898ab811272b2f2b0b87ab02c7a19
- SHA512 cd661431b22e181a2b9e703097645ff9520eedc08799a9acd31b31e68df1b7e055b52391630056dfde27a0fa96d624fdc5e1668a82147ec6a7482e6d915b759e
- SSDEEP 98304:Qzknz/NQTrHcnTDB1bhEoJahjk7mcPwy7T:Q+LNHn/nbixhyYI
- TLSH T16B767D07EC6914E9D1AED13189769163BB717C881B2123D72B50F6387FB6BE0ADB9340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c505-105.dat family_donutloader - Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4356 powershell.exe 2372 powershell.exe 4712 powershell.exe 3316 powershell.exe 4568 powershell.exe 3388 powershell.exe 2700 powershell.exe 2456 powershell.exe 5924 powershell.exe 2988 powershell.exe 1152 powershell.exe 2140 powershell.exe 2024 powershell.exe 620 powershell.exe 5744 powershell.exe 1832 powershell.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\QKARDrv.sys Dism.exe - Executes dropped EXE 1 IoCs
pid Process 5988 QKARDrv.sys - Loads dropped DLL 6 IoCs
pid Process 4360 MsiExec.exe 4360 MsiExec.exe 4360 MsiExec.exe 4360 MsiExec.exe 988 MsiExec.exe 988 MsiExec.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 9 988 MsiExec.exe 10 988 MsiExec.exe 11 988 MsiExec.exe 12 988 MsiExec.exe 13 988 MsiExec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 988 set thread context of 2520 988 MsiExec.exe 121 - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI650B.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF934425908E5AE7EB.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFF81DA135A52DE295.TMP msiexec.exe File created C:\Windows\Installer\e595683.msi msiexec.exe File created C:\Windows\SystemTemp\~DFD16E89A30404D4C4.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{27B05CA8-F1DE-4496-BE49-FD9C50FAC16D} msiexec.exe File created C:\Windows\SystemTemp\~DFA87889A5217F4902.TMP msiexec.exe File opened for modification C:\Windows\Installer\e595683.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI6354.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI648D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI652C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6898.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B67.tmp msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe Set value (data) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191836b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3312 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe 3312 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe 3312 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe 3312 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe 2140 powershell.exe 2140 powershell.exe 3388 powershell.exe 3388 powershell.exe 2456 powershell.exe 5744 powershell.exe 2456 powershell.exe 5744 powershell.exe 2700 powershell.exe 2700 powershell.exe 4356 powershell.exe 4356 powershell.exe 5744 powershell.exe 2140 powershell.exe 3388 powershell.exe 2456 powershell.exe 2700 powershell.exe 4356 powershell.exe 484 msiexec.exe 484 msiexec.exe 988 MsiExec.exe 988 MsiExec.exe 988 MsiExec.exe 988 MsiExec.exe 2372 powershell.exe 2372 powershell.exe 5924 powershell.exe 5924 powershell.exe 2372 powershell.exe 4712 powershell.exe 4712 powershell.exe 3316 powershell.exe 3316 powershell.exe 5924 powershell.exe 2024 powershell.exe 2024 powershell.exe 4712 powershell.exe 3316 powershell.exe 2024 powershell.exe 1832 powershell.exe 1832 powershell.exe 4568 powershell.exe 4568 powershell.exe 4568 powershell.exe 1832 powershell.exe 2988 powershell.exe 2988 powershell.exe 620 powershell.exe 620 powershell.exe 1152 powershell.exe 1152 powershell.exe 620 powershell.exe 2988 powershell.exe 1152 powershell.exe 988 MsiExec.exe 988 MsiExec.exe 988 MsiExec.exe 988 MsiExec.exe 988 MsiExec.exe 988 MsiExec.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2140 powershell.exe Token: SeDebugPrivilege 3388 powershell.exe Token: SeDebugPrivilege 2456 powershell.exe Token: SeDebugPrivilege 5744 powershell.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeDebugPrivilege 4356 powershell.exe Token: SeIncreaseQuotaPrivilege 5744 powershell.exe Token: SeSecurityPrivilege 5744 powershell.exe Token: SeTakeOwnershipPrivilege 5744 powershell.exe Token: SeLoadDriverPrivilege 5744 powershell.exe Token: SeSystemProfilePrivilege 5744 powershell.exe Token: SeSystemtimePrivilege 5744 powershell.exe Token: SeProfSingleProcessPrivilege 5744 powershell.exe Token: SeIncBasePriorityPrivilege 5744 powershell.exe Token: SeCreatePagefilePrivilege 5744 powershell.exe Token: SeBackupPrivilege 5744 powershell.exe Token: SeRestorePrivilege 5744 powershell.exe Token: SeShutdownPrivilege 5744 powershell.exe Token: SeDebugPrivilege 5744 powershell.exe Token: SeSystemEnvironmentPrivilege 5744 powershell.exe Token: SeRemoteShutdownPrivilege 5744 powershell.exe Token: SeUndockPrivilege 5744 powershell.exe Token: SeManageVolumePrivilege 5744 powershell.exe Token: 33 5744 powershell.exe Token: 34 5744 powershell.exe Token: 35 5744 powershell.exe Token: 36 5744 powershell.exe Token: SeIncreaseQuotaPrivilege 3388 powershell.exe Token: SeSecurityPrivilege 3388 powershell.exe Token: SeTakeOwnershipPrivilege 3388 powershell.exe Token: SeLoadDriverPrivilege 3388 powershell.exe Token: SeSystemProfilePrivilege 3388 powershell.exe Token: SeSystemtimePrivilege 3388 powershell.exe Token: SeProfSingleProcessPrivilege 3388 powershell.exe Token: SeIncBasePriorityPrivilege 3388 powershell.exe Token: SeCreatePagefilePrivilege 3388 powershell.exe Token: SeBackupPrivilege 3388 powershell.exe Token: SeRestorePrivilege 3388 powershell.exe Token: SeShutdownPrivilege 3388 powershell.exe Token: SeDebugPrivilege 3388 powershell.exe Token: SeSystemEnvironmentPrivilege 3388 powershell.exe Token: SeRemoteShutdownPrivilege 3388 powershell.exe Token: SeUndockPrivilege 3388 powershell.exe Token: SeManageVolumePrivilege 3388 powershell.exe Token: 33 3388 powershell.exe Token: 34 3388 powershell.exe Token: 35 3388 powershell.exe Token: 36 3388 powershell.exe Token: SeIncreaseQuotaPrivilege 2140 powershell.exe Token: SeSecurityPrivilege 2140 powershell.exe Token: SeTakeOwnershipPrivilege 2140 powershell.exe Token: SeLoadDriverPrivilege 2140 powershell.exe Token: SeSystemProfilePrivilege 2140 powershell.exe Token: SeSystemtimePrivilege 2140 powershell.exe Token: SeProfSingleProcessPrivilege 2140 powershell.exe Token: SeIncBasePriorityPrivilege 2140 powershell.exe Token: SeCreatePagefilePrivilege 2140 powershell.exe Token: SeBackupPrivilege 2140 powershell.exe Token: SeRestorePrivilege 2140 powershell.exe Token: SeShutdownPrivilege 2140 powershell.exe Token: SeDebugPrivilege 2140 powershell.exe Token: SeSystemEnvironmentPrivilege 2140 powershell.exe Token: SeRemoteShutdownPrivilege 2140 powershell.exe Token: SeUndockPrivilege 2140 powershell.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 484 msiexec.exe 4360 MsiExec.exe 988 MsiExec.exe 2520 Dism.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3312 wrote to memory of 5744 3312 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe 89 PID 3312 wrote to memory of 3388 3312 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe 90 PID 3312 wrote to memory of 2700 3312 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe 91 PID 3312 wrote to memory of 2456 3312 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe 92 PID 3312 wrote to memory of 2140 3312 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe 93 PID 3312 wrote to memory of 4356 3312 2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe 95 PID 484 wrote to memory of 4360 484 msiexec.exe 103 PID 484 wrote to memory of 988 484 msiexec.exe 105 PID 988 wrote to memory of 5924 988 MsiExec.exe 106 PID 988 wrote to memory of 2372 988 MsiExec.exe 108 PID 988 wrote to memory of 4712 988 MsiExec.exe 110 PID 988 wrote to memory of 2024 988 MsiExec.exe 112 PID 988 wrote to memory of 3316 988 MsiExec.exe 114 PID 2372 wrote to memory of 4568 2372 powershell.exe 116 PID 5924 wrote to memory of 1832 5924 powershell.exe 117 PID 3316 wrote to memory of 620 3316 powershell.exe 118 PID 4712 wrote to memory of 2988 4712 powershell.exe 119 PID 2024 wrote to memory of 1152 2024 powershell.exe 120 PID 988 wrote to memory of 2520 988 MsiExec.exe 121 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_129010160c5a269b8ab379b6995c4af7_coinminer_dosia_glassworm_poet-rat_quasar-rat_remcos_snatch.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5744
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DEA9B369518F6664457A3ABA100DC8412⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4360
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 57794B2BE8CE3F4F6FC9417B0CE3B80E2⤵
- Loads dropped DLL
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1832
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Windows\System324⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2988
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1152
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:620
-
-
-
C:\windows\system32\Dism.exeC:\windows\system32\Dism.exe3⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:2520
-
-
-
C:\Windows\system32\Drivers\QKARDrv.sysC:\Windows\system32\Drivers\QKARDrv.sys1⤵
- Executes dropped EXE
PID:5988
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e595686.rbs
- Size 3KB
- SHA256 c48b99b95e8b7614d77ea24c0b10b24268c324ce043f6927a4bc6881b11c323e
- MD5 5003f72e873d121926b31404166bd9a6
- SHA1 0f1cc6507edf752ba8900ad4c55fe93e38c6a671
- SHA512 db882810203173a119f5b8afa75e7a570fb2bdd3074a561df09553c33deffbeab43c03600e0ec8d0d2bc96b99d5c2a217b2744448b13c65d50b37120074b45c3
- TLSH T18761B27486D3C2CCD491E8F187E2A0BC9FD89D6A6E66F468DE0F4D6D6963140FC1814E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a0a38fa4a0bf711b40b4f5d515b4127180d4139620b90f7b3eed11b0e752d9f8
- MD5 8f0e8b6f726b79a87bb71040ffad48d3
- SHA1 86cb429d7d2005b1f3d535dee33ffa55d86186dc
- SHA512 329e0318eecf07128ce57bce9a541ee58416e51dd65b5b18bf196336d46c3aa1e2b6c551359e6b3eb1aa86aeb08e53a8df6ebb12f241f44fd82c61bd8a5dc149
- TLSH T14E216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e2df337578a728457eea143b06a428aacb70ee650ccce6c7901a2b2819172f37
- MD5 55f7f8a536f28dee16d47d239c4a675f
- SHA1 244a21f88978e2e8b5a13c68c7dbcd27a1f762e4
- SHA512 ee14e4bcc34eea2c3fd08535e07a711ef8bb4fdf8039be5dee9d16aa6116057e0aea0e25599e4f369bdf0111ee950d1d0ef1a43572ddea021af3bef4bb160320
- TLSH T1A9216833B3DD8624CC9A413A10CDAC1036BAC7DB41DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 744383017be6a53ec45127957d9c822a124503a8573696d6d2a6709b8916332d
- MD5 a27c8727967a5810efaa661ca20bf7b8
- SHA1 28d7bda12a7b49587a7d6389f6d4dfa479dbb8a3
- SHA512 d0433ffaf48211d2af30b9b124dc53670f9ab434aadbf9d70f3c3cf54c84a2c8faedc2f1e8e352d4e0353fe3a45d3d028b70fa7cea87892039507363cdb944bc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 f35553d369271b0331cb9aff9304f0cc14a4b53f8fea9c15f0fee2829484223f
- MD5 584637f5eea146316c3c53733cceba26
- SHA1 48f70eceb1d2b7480276f71422e801759c642ef1
- SHA512 f123757bc91e21bf11be6e24a4b6d7d42c149c0bdeb3a04325dc4a4b7ae65d4ee81db6a6a32f70b7931265b5c4ad8643856bcaa5088b30b75b1bdeac85441655
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 83a9cd7a935e9fa8f4f952faa76ad7a2a357666b337ee6048112ae34dd05f096
- MD5 b431bc51a442fd1c5e50d946d0a2453e
- SHA1 39bd6b6a981f67fc8fb072f77d9e09540cd1b2c9
- SHA512 697600ec5c8bc657b7dbaf0b70d28150d5f87408eca9083a362e451c98213c33b4ce7bc195c12e1e24371c55194130e664c7b83bb403c501ddd47723a3f39de0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e6ccd04f26fc2d26a9664b367a7c1cf7a184cf7fbe7e711bd59f5965c9fcac7f
- MD5 7723e548dee328d34dfb579a62c58157
- SHA1 62b1dc118197b8db7fbacd7229e66d6a3bcd8e2f
- SHA512 49557082a7bf18385ac0e06da814be2066f56f6bc8288b8c2a250005bb760482576191cdc0d39f1eab12a5638833ac6a67a5218071db1b0e5e87dc5bd6e1be32
- TLSH T167219833B3CC8624C89A413A10CDAC1036B6C7CB40DECFAB7B80E655A43F698DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1599754af315bf45fc5c21a5d9d6289ee5d77b66ecc79c44b56e93a2e4a258b3
- MD5 921a478d4b661d5dbabaa5056c375995
- SHA1 0f636740ac1adb46315e7380dca2d29c333d0456
- SHA512 ed439021bbee12984ea7fdfc5f2d78a2599748df67ecbfb6d92a78314e76ba9019d6971e78ea0a8bd0567d40a124483f0d48e7d42afd2f730e81614fe36b565f
- TLSH T1B8216833B3DD8614C89A413A10CEAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
- MD5 81b56f1dad28119d54bf23c83fc570b9
- SHA1 cb9a89a716465611149ce3c700bd60681d434faf
- SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
- TLSH T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t3thwozm.cjz.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\emjio.tmp
- Size 402KB
- SHA256 32152dca66b2bbc820a7ad6f92a2dbacde690f35ac01ba134f83cb00fec9dc3a
- MD5 031422a95fc10e5cd6483a7c6c9b3aec
- SHA1 45552601ddbc2aab77dcbe3b3537fffdf0fe2efd
- SHA512 ed4213b291282d4fd8eb0ceb8b01935ecbe4ca7fb2205cc769185726f1460877cf25e509de4adae3f2f5c7d7b16eea8f1079cb78b5f8ca0c67c113f55332e655
- SSDEEP 6144:1Yl3Dhe4nIMpUwCo+660ybbLjtA1uVwYqWyvAWHDELXAfE1beQgnJrsX3IsOugXR:1wE4xpUwCoFyjVC5A0EcsZexsH1Ji/F
- TLSH T1A49423DA58B0F4D34AB2B099FD457FBBEBD5342F49B1731A20B30B9A4DB24647A18134
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\resource.png
- Size 464KB
- SHA256 6a0a8df1ab1f4fbefe0959b7ef2a1adac61b401992c9959cee2a0f8c42b51ca6
- MD5 791ca7ad050f6cacad253902b2f4662f
- SHA1 54ab0f7b357c79e84aaedac8b2a6cbafc1ad73ce
- SHA512 0d57bd6f031bc1adc624d96fc44bcfed4771a5630abf9620c4b22370fbc754a9d560c18153386fae4ef862d01c6cb6128178122a865570ad79f41409032f5fae
- SSDEEP 12288:ai0ThSjctHtf9eo79RIj/xHeKOiVQIo08+tv+ic:a3Vtf9RoheKOm8ATc
- TLSH T1B1A4BCDC920076442EA5BEFC7F8AD7A20547373A4A8DA647C0179791CAB1CC64F07ADE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6354.tmp
- Size 557KB
- SHA256 e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
- MD5 db7612f0fd6408d664185cfc81bef0cb
- SHA1 19a6334ec00365b4f4e57d387ed885b32aa7c9aa
- SHA512 25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
- SSDEEP 6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
- TLSH T1AAC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6B67.tmp
- Size 25KB
- SHA256 eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6
- MD5 81902d13c01fd8a187f3a7f2b72d5dd0
- SHA1 0ac01518c5588eb2788730c78f0c581f79cf2ed4
- SHA512 04d6e2e937328477803084e0ef9da2c3636cdc9d34af74e2d1871d7190be21cbb2771ae835175e104e24eccba52add1ba6f58407bfd522ef82b81d76e977f24c
- SSDEEP 768:ZUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5:qXVoSnrfyjf5brQ0rPx
- TLSH T197C28EC753941886E13B8673AA8B8622FD76358003B09FDF1B98C1B51F93BD126BDB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\QKARDrv.sys
- Size 44KB
- SHA256 67fa1b21947b9e89022794afd7ada8fec6615a2de4b6ac4994b45f3d12fd5573
- MD5 b3d2ee44b1906db25ea572cb1d6dbc91
- SHA1 2d2ced069894f8ef114256aa746a1350da9b0e29
- SHA512 ceedcebc67b28c74e04ea2b5cc8fd266c1bb553ee99b54509731d9306db617824a7b9b85b891beb552265da385e39ae66411e586f53e8e3485a9a0e4e84871c8
- SSDEEP 768:UmO1aQiveP0LKn3RS3/QwBoLI21YpdpTxOLk5Q:BO1aQiveMLKn3RS3/QSdc
- TLSH T1F8136C4360C427B4EA22847581C2DC1AE0B578D557B389CF4695F861AAE7BF0EF369C3
- MD5 SHA1 SHA512 SSDEEP TLSH