Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 7.3MB
- Sample260801-dkzvgacf98
- SHA256 0dd1334bac1e22a1fbcd61c57fed7a174138226cba7747fbc9fa57cefe6eeb5a
- MD5 7c59fce8b6d4eb4b59ee99b46e9d3097
- SHA1 a583a8964163593ef553aa7c06258214ffc1933f
- SHA512 fd9eb0a57a6a23be9858268a281b40bf7f2b5bf68860551b99824681500176414ad744276896b7be65718207ecfbeca93731a38e82abdc0b2b1098e474285697
- SSDEEP 49152:Jztahl+MkOHojEZrwSbXpQM/5kD/ARj288RFg94XOlKbMWkkwCPKQK1K6D3x1g5O:Jzknz/NQTrHcnTDB1SEobYrECw7lcAwh
- TLSH T184768D47EC6954E9D1AED13089769163BB317C881B2123D72B50F6387FB6BE0ADB9340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c561-93.dat family_donutloader - Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 572 powershell.exe 240 powershell.exe 716 powershell.exe 2688 powershell.exe 2096 powershell.exe 1896 powershell.exe 2064 powershell.exe 1992 powershell.exe 1692 powershell.exe 5072 powershell.exe 1836 powershell.exe 3132 powershell.exe 108 powershell.exe 1492 powershell.exe 1288 powershell.exe 1436 powershell.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\QKARDrv.sys Dism.exe - Executes dropped EXE 1 IoCs
pid Process 1560 QKARDrv.sys - Loads dropped DLL 6 IoCs
pid Process 4780 MsiExec.exe 4780 MsiExec.exe 4780 MsiExec.exe 4780 MsiExec.exe 5836 MsiExec.exe 5836 MsiExec.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 10 5836 MsiExec.exe 12 5836 MsiExec.exe 13 5836 MsiExec.exe 14 5836 MsiExec.exe 15 5836 MsiExec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5836 set thread context of 3800 5836 MsiExec.exe 121 - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e591dee.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2D03.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF04BD1FF1F8CDECFC.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF31BE7E27DE911B50.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI34A8.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFCCD6C0802A597786.TMP msiexec.exe File created C:\Windows\Installer\e591dee.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI31B9.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI2BB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D81.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DC0.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF815673E41C7BCADF.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{27B05CA8-F1DE-4496-BE49-FD9C50FAC16D} msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191836b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4856 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4856 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4856 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4856 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 1492 powershell.exe 1492 powershell.exe 2688 powershell.exe 2688 powershell.exe 1692 powershell.exe 1692 powershell.exe 1288 powershell.exe 1288 powershell.exe 2096 powershell.exe 2096 powershell.exe 5072 powershell.exe 5072 powershell.exe 1288 powershell.exe 1692 powershell.exe 5072 powershell.exe 1492 powershell.exe 2096 powershell.exe 2688 powershell.exe 4860 msiexec.exe 4860 msiexec.exe 5836 MsiExec.exe 5836 MsiExec.exe 5836 MsiExec.exe 5836 MsiExec.exe 1836 powershell.exe 1836 powershell.exe 1896 powershell.exe 1896 powershell.exe 3132 powershell.exe 3132 powershell.exe 1896 powershell.exe 1436 powershell.exe 2064 powershell.exe 2064 powershell.exe 1436 powershell.exe 3132 powershell.exe 2064 powershell.exe 1436 powershell.exe 1836 powershell.exe 1992 powershell.exe 1992 powershell.exe 572 powershell.exe 572 powershell.exe 1992 powershell.exe 108 powershell.exe 108 powershell.exe 240 powershell.exe 240 powershell.exe 572 powershell.exe 716 powershell.exe 716 powershell.exe 108 powershell.exe 716 powershell.exe 240 powershell.exe 5836 MsiExec.exe 5836 MsiExec.exe 5836 MsiExec.exe 5836 MsiExec.exe 5836 MsiExec.exe 5836 MsiExec.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1492 powershell.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 2096 powershell.exe Token: SeDebugPrivilege 5072 powershell.exe Token: SeDebugPrivilege 1692 powershell.exe Token: SeDebugPrivilege 1288 powershell.exe Token: SeIncreaseQuotaPrivilege 1288 powershell.exe Token: SeSecurityPrivilege 1288 powershell.exe Token: SeTakeOwnershipPrivilege 1288 powershell.exe Token: SeLoadDriverPrivilege 1288 powershell.exe Token: SeSystemProfilePrivilege 1288 powershell.exe Token: SeSystemtimePrivilege 1288 powershell.exe Token: SeProfSingleProcessPrivilege 1288 powershell.exe Token: SeIncBasePriorityPrivilege 1288 powershell.exe Token: SeCreatePagefilePrivilege 1288 powershell.exe Token: SeBackupPrivilege 1288 powershell.exe Token: SeRestorePrivilege 1288 powershell.exe Token: SeShutdownPrivilege 1288 powershell.exe Token: SeDebugPrivilege 1288 powershell.exe Token: SeSystemEnvironmentPrivilege 1288 powershell.exe Token: SeRemoteShutdownPrivilege 1288 powershell.exe Token: SeUndockPrivilege 1288 powershell.exe Token: SeManageVolumePrivilege 1288 powershell.exe Token: 33 1288 powershell.exe Token: 34 1288 powershell.exe Token: 35 1288 powershell.exe Token: 36 1288 powershell.exe Token: SeIncreaseQuotaPrivilege 1692 powershell.exe Token: SeSecurityPrivilege 1692 powershell.exe Token: SeTakeOwnershipPrivilege 1692 powershell.exe Token: SeLoadDriverPrivilege 1692 powershell.exe Token: SeSystemProfilePrivilege 1692 powershell.exe Token: SeSystemtimePrivilege 1692 powershell.exe Token: SeProfSingleProcessPrivilege 1692 powershell.exe Token: SeIncBasePriorityPrivilege 1692 powershell.exe Token: SeCreatePagefilePrivilege 1692 powershell.exe Token: SeBackupPrivilege 1692 powershell.exe Token: SeRestorePrivilege 1692 powershell.exe Token: SeShutdownPrivilege 1692 powershell.exe Token: SeDebugPrivilege 1692 powershell.exe Token: SeSystemEnvironmentPrivilege 1692 powershell.exe Token: SeRemoteShutdownPrivilege 1692 powershell.exe Token: SeUndockPrivilege 1692 powershell.exe Token: SeManageVolumePrivilege 1692 powershell.exe Token: 33 1692 powershell.exe Token: 34 1692 powershell.exe Token: 35 1692 powershell.exe Token: 36 1692 powershell.exe Token: SeIncreaseQuotaPrivilege 5072 powershell.exe Token: SeSecurityPrivilege 5072 powershell.exe Token: SeTakeOwnershipPrivilege 5072 powershell.exe Token: SeLoadDriverPrivilege 5072 powershell.exe Token: SeSystemProfilePrivilege 5072 powershell.exe Token: SeSystemtimePrivilege 5072 powershell.exe Token: SeProfSingleProcessPrivilege 5072 powershell.exe Token: SeIncBasePriorityPrivilege 5072 powershell.exe Token: SeCreatePagefilePrivilege 5072 powershell.exe Token: SeBackupPrivilege 5072 powershell.exe Token: SeRestorePrivilege 5072 powershell.exe Token: SeShutdownPrivilege 5072 powershell.exe Token: SeDebugPrivilege 5072 powershell.exe Token: SeSystemEnvironmentPrivilege 5072 powershell.exe Token: SeRemoteShutdownPrivilege 5072 powershell.exe Token: SeUndockPrivilege 5072 powershell.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4860 msiexec.exe 4780 MsiExec.exe 5836 MsiExec.exe 3800 Dism.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4856 wrote to memory of 5072 4856 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 89 PID 4856 wrote to memory of 1692 4856 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 90 PID 4856 wrote to memory of 2096 4856 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 91 PID 4856 wrote to memory of 1492 4856 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 92 PID 4856 wrote to memory of 2688 4856 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 93 PID 4856 wrote to memory of 1288 4856 2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 94 PID 4860 wrote to memory of 4780 4860 msiexec.exe 103 PID 4860 wrote to memory of 5836 4860 msiexec.exe 104 PID 5836 wrote to memory of 1836 5836 MsiExec.exe 105 PID 5836 wrote to memory of 1896 5836 MsiExec.exe 107 PID 5836 wrote to memory of 3132 5836 MsiExec.exe 109 PID 5836 wrote to memory of 2064 5836 MsiExec.exe 111 PID 5836 wrote to memory of 1436 5836 MsiExec.exe 113 PID 1896 wrote to memory of 1992 1896 powershell.exe 115 PID 3132 wrote to memory of 572 3132 powershell.exe 116 PID 2064 wrote to memory of 108 2064 powershell.exe 117 PID 1436 wrote to memory of 240 1436 powershell.exe 118 PID 1836 wrote to memory of 716 1836 powershell.exe 119 PID 5836 wrote to memory of 3800 5836 MsiExec.exe 121 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_7c59fce8b6d4eb4b59ee99b46e9d3097_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B75C52538313716898714A9DE3DB18562⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4780
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding FA5FE8DC78C59464948A2822EA4557132⤵
- Loads dropped DLL
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Users4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:716
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\ProgramData4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1992
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath C:\Windows\System324⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:572
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess Dism.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:108
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess where.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:240
-
-
-
C:\windows\system32\Dism.exeC:\windows\system32\Dism.exe3⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:3800
-
-
-
C:\Windows\system32\Drivers\QKARDrv.sysC:\Windows\system32\Drivers\QKARDrv.sys1⤵
- Executes dropped EXE
PID:1560
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e591df1.rbs
- Size 3KB
- SHA256 d633a9b79f6e7d884691dfe11771300a12b984f046191250dac43b88de280292
- MD5 ab256d7d8eafdb827537ddf1d5a6dac5
- SHA1 e835bbe17bfbac12c8247ff34a76a067d1ec28c8
- SHA512 f12459788452a2d8e45f8f2515ea008618a99543599437759a8804591445b5ec75de7c4a9cebee752693e63a72aab829364801d360d88f4d10a88961a699a3e6
- TLSH T1EC61A17486D3C2CCD491E8F087E2A0BC9FD89D6A6E66E468DE0F4DAD6963140FC1814E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f95c6e0d0efdd934da81fd8b3e497e0780a76e0bd4ed9e8427482c2ebdacf92c
- MD5 c5ef52c933731efcef862f5380b82e9e
- SHA1 2534202cf9c56ed8a8ebf1684c22c937cd19e8d9
- SHA512 77a57439d3e797049151df8bbc7797ff6e970ca4db84190585b7485373b546bdc75484b7adef70e51ffe5bcd9059f19a8f445301ca69fb1e5e8138d461460c1f
- TLSH T144216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B7B84E655A43F699CE61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 3335c440a9d31396160678cd3014f43405b608d19f5f4b44e4d00bf9b231faba
- MD5 afc321dd3f13fbfa4d4d1196ef813cd1
- SHA1 380e8bd0f058cccfe512d2bcd5b55c8d7fef4267
- SHA512 7f39588740bd53c7ee852d657a103ef6acb1235f97a1eb1d1df9c7f45a23d36d799bd33db31ceef04090c2755c5c1521e6b39994515153a0f86941992859979a
- TLSH T19A216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0bad03cf4eb4a13781efb0cd812b6def8dadb64dba0eae55ad6c4fe2b1eb10a8
- MD5 ef3e30e11b66059f6029dbf4b9012d8e
- SHA1 5fb16e8dab3c41c5cff1809fd377de8624fca695
- SHA512 3b393bc68ee2be26ccab897c810d104f22c522b5f1f36ba51957ae48a446fb0f2ffc6cc3f8ac805cd227b518b0f5deede4f6b3363fb9623c3e2cb5aabea54a3d
- TLSH T176216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 e92c4096ccffc635cc8ef00e06c2701903d6fde076330d5a0197c5661d2cf385
- MD5 10300c38b2551240d3464bd740d2dbd1
- SHA1 52520dfc7599c0cc8e41b10026ed6889e84a6899
- SHA512 153eb12ef00dd6300f7e0376beb78b72e9134437641d36d26b27f51dc76f6042b5f4fa7dcf03bf378030a0e2cc48e0f673fe5b1f1f7985bb7c430b2764076ab1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 178d7eeaec5054ab43fe91a3d1664d9e217d078bfdbc7718a5971e2d68707304
- MD5 55c143e00f86b9eaf26900ddd242ceee
- SHA1 5d9444188d988e27d17b5c0f6df841bfdcc141fd
- SHA512 9b3696af09a6b01886b904d495dce10b90ec6f0714c57aa821bec8eb14563d1d7a1d378d50250afa24239585796b1b25910ed81138c173dc7994b143fbd46429
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 0cae1e1b1d407f5f44c77cf7f125e3518247974576a53677f04cbb14f3106d6c
- MD5 7b541bc4affc8ef4b331fb4adf0ed44f
- SHA1 43bbb72d9141f72b277f201643320d829a7d5937
- SHA512 c917dab9cf8dc9d9cd07a5f25aed07b936c58aa51edca5f585577c26c00ca28b59a5e1c866a0148057e4033fa49ff0f73392e18bbcc5d62a15613523f8a5acc3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 607a855a62c232a93e82cc73d72034c44632df8733b70c21f9a60ef3091d8b4c
- MD5 65699a3ef365576a827f6e6759abe335
- SHA1 4acfef388564565c7de8d222e0ca71fb4885a458
- SHA512 cfa442dab074d674b66d89aae51361871bf3a611efabe2653872a7c4c3eb6c1638a9ec739bd3c88f1d95299ae98854e2ba58801ff67f53c05a1698ae0881d29a
- TLSH T13A216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
- MD5 81b56f1dad28119d54bf23c83fc570b9
- SHA1 cb9a89a716465611149ce3c700bd60681d434faf
- SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
- TLSH T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
- MD5 acbc65123954839a819fa2495d239bf7
- SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
- SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
- TLSH T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 82fb99dc0cd12ba5e5b7a360092f848d2fbb2775d12ccb3aa60d8b3710ccc91a
- MD5 9e67f340014cbaf62f2fb8c7a539d21b
- SHA1 f0ed976f190cbdf1b9b643c93b97d101cb87e3ae
- SHA512 9c86e7c8cfd1971b16e7b82d6ab9c9539e115402d205efff6f2ef941bc0e09a479e31ecff8a3510c8c7ade3f65cdab7b4f1eda357438b854be29349aaccb93e6
- TLSH T1E7216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fb35scyl.jyn.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\emjio.tmp
- Size 402KB
- SHA256 32152dca66b2bbc820a7ad6f92a2dbacde690f35ac01ba134f83cb00fec9dc3a
- MD5 031422a95fc10e5cd6483a7c6c9b3aec
- SHA1 45552601ddbc2aab77dcbe3b3537fffdf0fe2efd
- SHA512 ed4213b291282d4fd8eb0ceb8b01935ecbe4ca7fb2205cc769185726f1460877cf25e509de4adae3f2f5c7d7b16eea8f1079cb78b5f8ca0c67c113f55332e655
- SSDEEP 6144:1Yl3Dhe4nIMpUwCo+660ybbLjtA1uVwYqWyvAWHDELXAfE1beQgnJrsX3IsOugXR:1wE4xpUwCoFyjVC5A0EcsZexsH1Ji/F
- TLSH T1A49423DA58B0F4D34AB2B099FD457FBBEBD5342F49B1731A20B30B9A4DB24647A18134
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\68-new-1.4.7-win-x64-setup\68-new-1.4.7-win-x64-setup\resource.png
- Size 464KB
- SHA256 6a0a8df1ab1f4fbefe0959b7ef2a1adac61b401992c9959cee2a0f8c42b51ca6
- MD5 791ca7ad050f6cacad253902b2f4662f
- SHA1 54ab0f7b357c79e84aaedac8b2a6cbafc1ad73ce
- SHA512 0d57bd6f031bc1adc624d96fc44bcfed4771a5630abf9620c4b22370fbc754a9d560c18153386fae4ef862d01c6cb6128178122a865570ad79f41409032f5fae
- SSDEEP 12288:ai0ThSjctHtf9eo79RIj/xHeKOiVQIo08+tv+ic:a3Vtf9RoheKOm8ATc
- TLSH T1B1A4BCDC920076442EA5BEFC7F8AD7A20547373A4A8DA647C0179791CAB1CC64F07ADE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2BB9.tmp
- Size 557KB
- SHA256 e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
- MD5 db7612f0fd6408d664185cfc81bef0cb
- SHA1 19a6334ec00365b4f4e57d387ed885b32aa7c9aa
- SHA512 25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
- SSDEEP 6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
- TLSH T1AAC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI34A8.tmp
- Size 25KB
- SHA256 eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6
- MD5 81902d13c01fd8a187f3a7f2b72d5dd0
- SHA1 0ac01518c5588eb2788730c78f0c581f79cf2ed4
- SHA512 04d6e2e937328477803084e0ef9da2c3636cdc9d34af74e2d1871d7190be21cbb2771ae835175e104e24eccba52add1ba6f58407bfd522ef82b81d76e977f24c
- SSDEEP 768:ZUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5:qXVoSnrfyjf5brQ0rPx
- TLSH T197C28EC753941886E13B8673AA8B8622FD76358003B09FDF1B98C1B51F93BD126BDB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\QKARDrv.sys
- Size 44KB
- SHA256 67fa1b21947b9e89022794afd7ada8fec6615a2de4b6ac4994b45f3d12fd5573
- MD5 b3d2ee44b1906db25ea572cb1d6dbc91
- SHA1 2d2ced069894f8ef114256aa746a1350da9b0e29
- SHA512 ceedcebc67b28c74e04ea2b5cc8fd266c1bb553ee99b54509731d9306db617824a7b9b85b891beb552265da385e39ae66411e586f53e8e3485a9a0e4e84871c8
- SSDEEP 768:UmO1aQiveP0LKn3RS3/QwBoLI21YpdpTxOLk5Q:BO1aQiveMLKn3RS3/QSdc
- TLSH T1F8136C4360C427B4EA22847581C2DC1AE0B578D557B389CF4695F861AAE7BF0EF369C3
- MD5 SHA1 SHA512 SSDEEP TLSH