Analysis
- max time kernel
30s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/08/2026, 11:16
General
- Target 2026-08-01_0dd80280292ecff1ad80b7e09d567147_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 5.4MB
- Sample260801-ndj6jstdje
- SHA256 e88ee5dd13ffde22e1c86b5cb196a6e7dbf6cd78ae1db5a55cda84fd6ea223e0
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 44 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 42 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 22 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Looks up external IP address via web service 1 TTPs 64 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 53 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 53 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_0dd80280292ecff1ad80b7e09d567147_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_0dd80280292ecff1ad80b7e09d567147_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_0dd80280292ecff1ad80b7e09d567147_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_0dd80280292ecff1ad80b7e09d567147_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\npjqvu5j\z56eyb9f.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\npjqvu5j\z56eyb9f.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\npjqvu5j\z56eyb9f.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\npjqvu5j\z56eyb9f.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\npjqvu5j\z56eyb9f.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\npjqvu5j\z56eyb9f.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\82ncc3ew\au7v61rp.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\82ncc3ew\au7v61rp.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\82ncc3ew\au7v61rp.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\82ncc3ew\au7v61rp.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\82ncc3ew\au7v61rp.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\82ncc3ew\au7v61rp.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pz2tvptq\9vwjl7dz.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pz2tvptq\9vwjl7dz.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pz2tvptq\9vwjl7dz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pz2tvptq\9vwjl7dz.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pz2tvptq\9vwjl7dz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pz2tvptq\9vwjl7dz.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qihh9dg6\0pl656jf.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qihh9dg6\0pl656jf.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qihh9dg6\0pl656jf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qihh9dg6\0pl656jf.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qihh9dg6\0pl656jf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qihh9dg6\0pl656jf.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ea4q4wn3\6nwgwyiw.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ea4q4wn3\6nwgwyiw.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ea4q4wn3\6nwgwyiw.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ea4q4wn3\6nwgwyiw.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ea4q4wn3\6nwgwyiw.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ea4q4wn3\6nwgwyiw.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dsyy06ep\a6zpfmqi.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dsyy06ep\a6zpfmqi.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dsyy06ep\a6zpfmqi.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dsyy06ep\a6zpfmqi.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dsyy06ep\a6zpfmqi.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dsyy06ep\a6zpfmqi.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nfw3ixd\l4cyuh8i.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nfw3ixd\l4cyuh8i.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nfw3ixd\l4cyuh8i.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nfw3ixd\l4cyuh8i.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nfw3ixd\l4cyuh8i.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nfw3ixd\l4cyuh8i.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mg2vmth7\wbtsf2zx.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mg2vmth7\wbtsf2zx.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mg2vmth7\wbtsf2zx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mg2vmth7\wbtsf2zx.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mg2vmth7\wbtsf2zx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mg2vmth7\wbtsf2zx.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4plabor\sfvbtg6w.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4plabor\sfvbtg6w.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4plabor\sfvbtg6w.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4plabor\sfvbtg6w.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4plabor\sfvbtg6w.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4plabor\sfvbtg6w.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbv2nnfk\6wi3v8hn.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbv2nnfk\6wi3v8hn.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbv2nnfk\6wi3v8hn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbv2nnfk\6wi3v8hn.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbv2nnfk\6wi3v8hn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbv2nnfk\6wi3v8hn.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d6qwyvzb\7kz81lhx.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d6qwyvzb\7kz81lhx.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d6qwyvzb\7kz81lhx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d6qwyvzb\7kz81lhx.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d6qwyvzb\7kz81lhx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d6qwyvzb\7kz81lhx.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pv7axtzv\ol2sr4de.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pv7axtzv\ol2sr4de.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pv7axtzv\ol2sr4de.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pv7axtzv\ol2sr4de.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pv7axtzv\ol2sr4de.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pv7axtzv\ol2sr4de.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4qd02e3t\lrabopmt.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4qd02e3t\lrabopmt.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4qd02e3t\lrabopmt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4qd02e3t\lrabopmt.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4qd02e3t\lrabopmt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4qd02e3t\lrabopmt.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtkyf2hz\pbiwtfrl.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtkyf2hz\pbiwtfrl.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtkyf2hz\pbiwtfrl.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtkyf2hz\pbiwtfrl.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtkyf2hz\pbiwtfrl.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtkyf2hz\pbiwtfrl.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29sw8cft\r1zouh0f.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29sw8cft\r1zouh0f.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29sw8cft\r1zouh0f.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29sw8cft\r1zouh0f.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29sw8cft\r1zouh0f.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29sw8cft\r1zouh0f.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pkty0sm6\bdlrrazd.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pkty0sm6\bdlrrazd.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pkty0sm6\bdlrrazd.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pkty0sm6\bdlrrazd.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pkty0sm6\bdlrrazd.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pkty0sm6\bdlrrazd.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztui4xa\pyf8hvx4.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztui4xa\pyf8hvx4.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztui4xa\pyf8hvx4.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztui4xa\pyf8hvx4.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztui4xa\pyf8hvx4.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztui4xa\pyf8hvx4.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nlx4f8v\5jse7jtn.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nlx4f8v\5jse7jtn.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nlx4f8v\5jse7jtn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nlx4f8v\5jse7jtn.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nlx4f8v\5jse7jtn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nlx4f8v\5jse7jtn.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\137mp83x\hrfud8bp.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\137mp83x\hrfud8bp.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\137mp83x\hrfud8bp.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\137mp83x\hrfud8bp.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\137mp83x\hrfud8bp.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\137mp83x\hrfud8bp.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5gmc4oxm\9jszfpa8.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5gmc4oxm\9jszfpa8.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5gmc4oxm\9jszfpa8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5gmc4oxm\9jszfpa8.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5gmc4oxm\9jszfpa8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5gmc4oxm\9jszfpa8.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gnbim20i\p3rsf2hm.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gnbim20i\p3rsf2hm.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gnbim20i\p3rsf2hm.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gnbim20i\p3rsf2hm.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gnbim20i\p3rsf2hm.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gnbim20i\p3rsf2hm.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzfo2uxj\7v6fprc9.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzfo2uxj\7v6fprc9.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzfo2uxj\7v6fprc9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzfo2uxj\7v6fprc9.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzfo2uxj\7v6fprc9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzfo2uxj\7v6fprc9.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djctvq5v\e3p7ewck.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djctvq5v\e3p7ewck.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djctvq5v\e3p7ewck.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djctvq5v\e3p7ewck.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djctvq5v\e3p7ewck.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djctvq5v\e3p7ewck.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5n50pzv\38k6s3u4.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5n50pzv\38k6s3u4.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5n50pzv\38k6s3u4.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5n50pzv\38k6s3u4.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5n50pzv\38k6s3u4.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5n50pzv\38k6s3u4.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1jjv58z0\gfv2fyqb.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1jjv58z0\gfv2fyqb.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1jjv58z0\gfv2fyqb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1jjv58z0\gfv2fyqb.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1jjv58z0\gfv2fyqb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1jjv58z0\gfv2fyqb.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zgq31j6b\h684rf1o.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zgq31j6b\h684rf1o.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zgq31j6b\h684rf1o.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zgq31j6b\h684rf1o.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zgq31j6b\h684rf1o.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zgq31j6b\h684rf1o.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3zqeswdv\0c1iuota.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3zqeswdv\0c1iuota.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3zqeswdv\0c1iuota.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3zqeswdv\0c1iuota.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3zqeswdv\0c1iuota.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3zqeswdv\0c1iuota.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rwko2njp\p7yw2gp9.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rwko2njp\p7yw2gp9.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rwko2njp\p7yw2gp9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rwko2njp\p7yw2gp9.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rwko2njp\p7yw2gp9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rwko2njp\p7yw2gp9.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fliotszv\i5cyb7vf.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fliotszv\i5cyb7vf.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fliotszv\i5cyb7vf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fliotszv\i5cyb7vf.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fliotszv\i5cyb7vf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fliotszv\i5cyb7vf.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqsf33jk\lm2psh3c.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqsf33jk\lm2psh3c.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqsf33jk\lm2psh3c.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqsf33jk\lm2psh3c.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqsf33jk\lm2psh3c.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqsf33jk\lm2psh3c.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5d5lkg0\uppafum3.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5d5lkg0\uppafum3.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5d5lkg0\uppafum3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5d5lkg0\uppafum3.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5d5lkg0\uppafum3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5d5lkg0\uppafum3.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfgxbzo2\zyvc6o60.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfgxbzo2\zyvc6o60.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfgxbzo2\zyvc6o60.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfgxbzo2\zyvc6o60.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfgxbzo2\zyvc6o60.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfgxbzo2\zyvc6o60.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5aci04es\3nzs2q59.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5aci04es\3nzs2q59.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5aci04es\3nzs2q59.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5aci04es\3nzs2q59.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5aci04es\3nzs2q59.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5aci04es\3nzs2q59.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rj8uh9qb\ihjuygd2.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rj8uh9qb\ihjuygd2.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rj8uh9qb\ihjuygd2.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rj8uh9qb\ihjuygd2.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rj8uh9qb\ihjuygd2.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rj8uh9qb\ihjuygd2.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cs5j47z\1ewipuzg.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cs5j47z\1ewipuzg.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cs5j47z\1ewipuzg.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cs5j47z\1ewipuzg.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cs5j47z\1ewipuzg.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cs5j47z\1ewipuzg.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bm7ay5yx\3rzaei7j.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bm7ay5yx\3rzaei7j.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bm7ay5yx\3rzaei7j.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bm7ay5yx\3rzaei7j.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bm7ay5yx\3rzaei7j.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bm7ay5yx\3rzaei7j.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\plei8xwr\6rcthm8a.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\plei8xwr\6rcthm8a.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\plei8xwr\6rcthm8a.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\plei8xwr\6rcthm8a.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\plei8xwr\6rcthm8a.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\plei8xwr\6rcthm8a.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iskpxoxp\9h66vlui.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iskpxoxp\9h66vlui.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iskpxoxp\9h66vlui.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iskpxoxp\9h66vlui.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iskpxoxp\9h66vlui.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iskpxoxp\9h66vlui.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qwmilhh0\rn21h951.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qwmilhh0\rn21h951.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qwmilhh0\rn21h951.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qwmilhh0\rn21h951.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qwmilhh0\rn21h951.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qwmilhh0\rn21h951.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\otxiiaec\ihedknw8.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\otxiiaec\ihedknw8.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\otxiiaec\ihedknw8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\otxiiaec\ihedknw8.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\otxiiaec\ihedknw8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\otxiiaec\ihedknw8.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmrctifp\hh9cj18j.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmrctifp\hh9cj18j.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmrctifp\hh9cj18j.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmrctifp\hh9cj18j.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmrctifp\hh9cj18j.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmrctifp\hh9cj18j.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\reexbpxw\e82f2u0k.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\reexbpxw\e82f2u0k.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\reexbpxw\e82f2u0k.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\reexbpxw\e82f2u0k.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\reexbpxw\e82f2u0k.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\reexbpxw\e82f2u0k.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mpixui1c\kw1pddby.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mpixui1c\kw1pddby.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mpixui1c\kw1pddby.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mpixui1c\kw1pddby.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mpixui1c\kw1pddby.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mpixui1c\kw1pddby.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ii4du4bw\8vaj0hul.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ii4du4bw\8vaj0hul.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ii4du4bw\8vaj0hul.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ii4du4bw\8vaj0hul.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ii4du4bw\8vaj0hul.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ii4du4bw\8vaj0hul.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsy63o7q\i33m59fn.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsy63o7q\i33m59fn.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsy63o7q\i33m59fn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsy63o7q\i33m59fn.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsy63o7q\i33m59fn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsy63o7q\i33m59fn.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s27xk7ma\sjni4pe9.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s27xk7ma\sjni4pe9.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s27xk7ma\sjni4pe9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s27xk7ma\sjni4pe9.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s27xk7ma\sjni4pe9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s27xk7ma\sjni4pe9.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2avpl8dv\drkoir9i.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2avpl8dv\drkoir9i.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2avpl8dv\drkoir9i.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2avpl8dv\drkoir9i.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2avpl8dv\drkoir9i.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2avpl8dv\drkoir9i.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jym36cf8\eb3ojzfz.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jym36cf8\eb3ojzfz.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jym36cf8\eb3ojzfz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jym36cf8\eb3ojzfz.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jym36cf8\eb3ojzfz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jym36cf8\eb3ojzfz.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\skyrmjc1\aqzw9z3d.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\skyrmjc1\aqzw9z3d.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\skyrmjc1\aqzw9z3d.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\skyrmjc1\aqzw9z3d.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\skyrmjc1\aqzw9z3d.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\skyrmjc1\aqzw9z3d.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q2jzy6x9\tx2ankqn.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q2jzy6x9\tx2ankqn.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q2jzy6x9\tx2ankqn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q2jzy6x9\tx2ankqn.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q2jzy6x9\tx2ankqn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q2jzy6x9\tx2ankqn.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m8zc8paq\kh5od8pl.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m8zc8paq\kh5od8pl.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m8zc8paq\kh5od8pl.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m8zc8paq\kh5od8pl.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m8zc8paq\kh5od8pl.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m8zc8paq\kh5od8pl.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sn8obyiz\xh0jx6mv.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sn8obyiz\xh0jx6mv.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sn8obyiz\xh0jx6mv.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sn8obyiz\xh0jx6mv.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sn8obyiz\xh0jx6mv.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sn8obyiz\xh0jx6mv.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0y8gaqo\kehnov2l.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0y8gaqo\kehnov2l.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0y8gaqo\kehnov2l.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0y8gaqo\kehnov2l.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
libcrypto-1_1.dll
libssl-1_1.dll
python39.dll
select.pyd
unicodedata.pyd
z56eyb9f.exe
memory/976-445-0x00000233BB910000-0x00000233BBA24000-memory.dmp
memory/5084-401-0x000002301EE10000-0x000002301F15D000-memory.dmp