b1c3875fa415ec148c467fb28fb2a6faf113676343b01aea81dbd0c91760175a

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 8.6MB
Sample260802-rmpdeabp2z
SHA256 b1c3875fa415ec148c467fb28fb2a6faf113676343b01aea81dbd0c91760175a
MD5 6c84f5914bf551166e9958c8430ad5d3
SHA1 3277803a5dd5510f82744c50a4f8f69eca58656d
SHA512 e4445955bc574add54dd567781cc6f1de15958ade41de7c04865a5a14183701d010556ad3233f27cf1ab3c0e3a419b7d890f9545f82acaf1d6ed292bf016ce2b
SSDEEP 196608:/kfBUGipNTwhLbxKdynGCxdGjP5ii2bjKVPy2wEak0ax82kEQOQdbhpAX:8fBU7eLbcdynGCnGjUi2bjRouaxXkEbf
TLSH
T1B8963399A6C104E6E9A746388CE3E135D6B4FC221322D6CB13D189573F236F6783D768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe

Identifies Xen via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\XEN	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	reg.exe

Loads dropped DLL 17 IoCs

pid	Process
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
5	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
3	api.ipify.org

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5004	tasklist.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4684	sc.exe
6128	sc.exe
1944	sc.exe
3872	sc.exe
5800	sc.exe
2840	sc.exe
3724	sc.exe
472	sc.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2324	wmic.exe
4940	wmic.exe

Modifies registry key 1 TTPs 11 IoCs

Modify Registry

T1112

pid	Process
4076	reg.exe
4572	reg.exe
4144	reg.exe
2484	reg.exe
1316	reg.exe
620	reg.exe
4800	reg.exe
3004	reg.exe
6084	reg.exe
6100	reg.exe
3520	reg.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1216	wmic.exe
1216	wmic.exe
1216	wmic.exe
1216	wmic.exe
716	wmic.exe
716	wmic.exe
716	wmic.exe
716	wmic.exe
4152	wmic.exe
4152	wmic.exe
4152	wmic.exe
4152	wmic.exe
2688	wmic.exe
2688	wmic.exe
2688	wmic.exe
2688	wmic.exe
4940	wmic.exe
4940	wmic.exe
4940	wmic.exe
4940	wmic.exe
3516	wmic.exe
3516	wmic.exe
3516	wmic.exe
3516	wmic.exe
5656	wmic.exe
5656	wmic.exe
5656	wmic.exe
5656	wmic.exe
2324	wmic.exe
2324	wmic.exe
2324	wmic.exe
2324	wmic.exe
1684	wmic.exe
1684	wmic.exe
1684	wmic.exe
1684	wmic.exe
2056	wmic.exe
2056	wmic.exe
2056	wmic.exe
2056	wmic.exe
1644	wmic.exe
1644	wmic.exe
1644	wmic.exe
1644	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1216	wmic.exe
Token: SeSecurityPrivilege	1216	wmic.exe
Token: SeTakeOwnershipPrivilege	1216	wmic.exe
Token: SeLoadDriverPrivilege	1216	wmic.exe
Token: SeSystemProfilePrivilege	1216	wmic.exe
Token: SeSystemtimePrivilege	1216	wmic.exe
Token: SeProfSingleProcessPrivilege	1216	wmic.exe
Token: SeIncBasePriorityPrivilege	1216	wmic.exe
Token: SeCreatePagefilePrivilege	1216	wmic.exe
Token: SeBackupPrivilege	1216	wmic.exe
Token: SeRestorePrivilege	1216	wmic.exe
Token: SeShutdownPrivilege	1216	wmic.exe
Token: SeDebugPrivilege	1216	wmic.exe
Token: SeSystemEnvironmentPrivilege	1216	wmic.exe
Token: SeRemoteShutdownPrivilege	1216	wmic.exe
Token: SeUndockPrivilege	1216	wmic.exe
Token: SeManageVolumePrivilege	1216	wmic.exe
Token: 33	1216	wmic.exe
Token: 34	1216	wmic.exe
Token: 35	1216	wmic.exe
Token: 36	1216	wmic.exe
Token: SeIncreaseQuotaPrivilege	1216	wmic.exe
Token: SeSecurityPrivilege	1216	wmic.exe
Token: SeTakeOwnershipPrivilege	1216	wmic.exe
Token: SeLoadDriverPrivilege	1216	wmic.exe
Token: SeSystemProfilePrivilege	1216	wmic.exe
Token: SeSystemtimePrivilege	1216	wmic.exe
Token: SeProfSingleProcessPrivilege	1216	wmic.exe
Token: SeIncBasePriorityPrivilege	1216	wmic.exe
Token: SeCreatePagefilePrivilege	1216	wmic.exe
Token: SeBackupPrivilege	1216	wmic.exe
Token: SeRestorePrivilege	1216	wmic.exe
Token: SeShutdownPrivilege	1216	wmic.exe
Token: SeDebugPrivilege	1216	wmic.exe
Token: SeSystemEnvironmentPrivilege	1216	wmic.exe
Token: SeRemoteShutdownPrivilege	1216	wmic.exe
Token: SeUndockPrivilege	1216	wmic.exe
Token: SeManageVolumePrivilege	1216	wmic.exe
Token: 33	1216	wmic.exe
Token: 34	1216	wmic.exe
Token: 35	1216	wmic.exe
Token: 36	1216	wmic.exe
Token: SeIncreaseQuotaPrivilege	716	wmic.exe
Token: SeSecurityPrivilege	716	wmic.exe
Token: SeTakeOwnershipPrivilege	716	wmic.exe
Token: SeLoadDriverPrivilege	716	wmic.exe
Token: SeSystemProfilePrivilege	716	wmic.exe
Token: SeSystemtimePrivilege	716	wmic.exe
Token: SeProfSingleProcessPrivilege	716	wmic.exe
Token: SeIncBasePriorityPrivilege	716	wmic.exe
Token: SeCreatePagefilePrivilege	716	wmic.exe
Token: SeBackupPrivilege	716	wmic.exe
Token: SeRestorePrivilege	716	wmic.exe
Token: SeShutdownPrivilege	716	wmic.exe
Token: SeDebugPrivilege	716	wmic.exe
Token: SeSystemEnvironmentPrivilege	716	wmic.exe
Token: SeRemoteShutdownPrivilege	716	wmic.exe
Token: SeUndockPrivilege	716	wmic.exe
Token: SeManageVolumePrivilege	716	wmic.exe
Token: 33	716	wmic.exe
Token: 34	716	wmic.exe
Token: 35	716	wmic.exe
Token: 36	716	wmic.exe
Token: SeIncreaseQuotaPrivilege	716	wmic.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1172	1864	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 1172 wrote to memory of 1216	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 1172 wrote to memory of 716	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 1172 wrote to memory of 4152	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 1172 wrote to memory of 2688	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 1172 wrote to memory of 4940	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 1172 wrote to memory of 3516	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 1172 wrote to memory of 5656	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 1172 wrote to memory of 4736	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	99
PID 1172 wrote to memory of 4324	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	100
PID 1172 wrote to memory of 6084	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 1172 wrote to memory of 6100	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 1172 wrote to memory of 3520	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 1172 wrote to memory of 4076	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	104
PID 1172 wrote to memory of 4572	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 1172 wrote to memory of 620	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 1172 wrote to memory of 4800	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 1172 wrote to memory of 4144	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 1172 wrote to memory of 2484	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 1172 wrote to memory of 1316	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 1172 wrote to memory of 3188	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	111
PID 1172 wrote to memory of 5004	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 1172 wrote to memory of 1148	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	113
PID 1172 wrote to memory of 5800	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 1172 wrote to memory of 2608	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 1172 wrote to memory of 2840	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 1172 wrote to memory of 4908	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	117
PID 1172 wrote to memory of 3724	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	118
PID 1172 wrote to memory of 3424	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 1172 wrote to memory of 472	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	120
PID 1172 wrote to memory of 2612	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 1172 wrote to memory of 4684	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	122
PID 1172 wrote to memory of 3080	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	123
PID 1172 wrote to memory of 6128	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	124
PID 1172 wrote to memory of 1528	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	125
PID 1172 wrote to memory of 1944	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 1172 wrote to memory of 4556	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	127
PID 1172 wrote to memory of 3872	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 1172 wrote to memory of 2324	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	129
PID 1172 wrote to memory of 1684	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	130
PID 1172 wrote to memory of 2056	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	131
PID 1172 wrote to memory of 3004	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	132
PID 1172 wrote to memory of 1644	1172	2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_6c84f5914bf551166e9958c8430ad5d3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\System32\Wbem\wmic.exe
    wmic computersystem get manufacturer,model /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- - C:\Windows\System32\Wbem\wmic.exe
    wmic bios get serialnumber /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- - C:\Windows\System32\Wbem\wmic.exe
    wmic memorychip get capacity /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4152
- - C:\Windows\System32\Wbem\wmic.exe
    wmic diskdrive get size /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2688
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_VideoController get name,adapterRAM,driverVersion,adapterCompatibility,/format:csv
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:4940
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_Battery get estimatedChargeRemaining,batteryStatus,designCapacity,fullChargedCapacity,/format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3516
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_SystemEnclosure get chassisTypes,manufacturer,serialnumber,/format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5656
- - C:\Windows\SYSTEM32\reg.exe
    reg query "HKLM\SOFTWARE\VMware\VMware Tools"
    3⤵
    PID:4736
- - C:\Windows\SYSTEM32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:4324
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest
    3⤵
    - Enumerates VirtualBox registry keys
    - Modifies registry key
    PID:6084
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\vmmouse
    3⤵
    - Looks for VMWare services registry key.
    - Modifies registry key
    PID:6100
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\VMTools
    3⤵
    - Looks for VMWare services registry key.
    - Modifies registry key
    PID:3520
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\VMAuthdService
    3⤵
    - Modifies registry key
    PID:4076
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\vmxnet
    3⤵
    - Modifies registry key
    PID:4572
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\vmx_svga
    3⤵
    - Modifies registry key
    PID:620
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\pvscsi
    3⤵
    - Modifies registry key
    PID:4800
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\HARDWARE\ACPI\FADT\VRTUAL
    3⤵
    - Modifies registry key
    PID:4144
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\HARDWARE\ACPI\FADT\XEN
    3⤵
    - Identifies Xen via ACPI registry values (likely anti-VM)
    - Modifies registry key
    PID:2484
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SOFTWARE\Citrix\Install
    3⤵
    - Modifies registry key
    PID:1316
- - C:\Windows\SYSTEM32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\QEMU Guest Agent"
    3⤵
    PID:3188
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV
    3⤵
    - Discovers running processes
    PID:5004
- - C:\Windows\SYSTEM32\where.exe
    where vmmouse.sys
    3⤵
    PID:1148
- - C:\Windows\SYSTEM32\sc.exe
    sc query vmmouse
    3⤵
    - Launches sc.exe
    PID:5800
- - C:\Windows\SYSTEM32\where.exe
    where vboxguest.sys
    3⤵
    PID:2608
- - C:\Windows\SYSTEM32\sc.exe
    sc query vboxguest
    3⤵
    - Launches sc.exe
    PID:2840
- - C:\Windows\SYSTEM32\where.exe
    where xenbus.sys
    3⤵
    PID:4908
- - C:\Windows\SYSTEM32\sc.exe
    sc query xenbus
    3⤵
    - Launches sc.exe
    PID:3724
- - C:\Windows\SYSTEM32\where.exe
    where xennet.sys
    3⤵
    PID:3424
- - C:\Windows\SYSTEM32\sc.exe
    sc query xennet
    3⤵
    - Launches sc.exe
    PID:472
- - C:\Windows\SYSTEM32\where.exe
    where xeniface.sys
    3⤵
    PID:2612
- - C:\Windows\SYSTEM32\sc.exe
    sc query xeniface
    3⤵
    - Launches sc.exe
    PID:4684
- - C:\Windows\SYSTEM32\where.exe
    where vmsrvc.sys
    3⤵
    PID:3080
- - C:\Windows\SYSTEM32\sc.exe
    sc query vmsrvc
    3⤵
    - Launches sc.exe
    PID:6128
- - C:\Windows\SYSTEM32\where.exe
    where vm3dgl.sys
    3⤵
    PID:1528
- - C:\Windows\SYSTEM32\sc.exe
    sc query vm3dgl
    3⤵
    - Launches sc.exe
    PID:1944
- - C:\Windows\SYSTEM32\where.exe
    where vmtray.sys
    3⤵
    PID:4556
- - C:\Windows\SYSTEM32\sc.exe
    sc query vmtray
    3⤵
    - Launches sc.exe
    PID:3872
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_VideoController get name /format:csv
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:2324
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_DiskDrive get model /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_PortConnector get /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2056
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Modifies registry key
    PID:3004
- - C:\Windows\System32\Wbem\wmic.exe
    wmic service get name /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_ctypes.pyd
Size 131KB
SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
MD5 744a8886e7187cb632da61e2d48ebafa
SHA1 e105fe498617813f2d34e578d48b82e23e56a972
SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
TLSH
T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_hashlib.pyd
Size 67KB
SHA256 5eb4a2aa9e28b49cb2a4f6ecee21f3c2b629b43a0709bad1d7e6204bac74eac2
MD5 648a300c9deda89218f23faacd7b0d17
SHA1 fd5fda7807cbfbaa23d052fcd8140d7ff4e98ff6
SHA512 27a8dc1dc1dad7aeed93912b9544760a984e5e3da0014fce1b66170079992cfea36c18212024982336d415ddb17db114ca0c45c85dabf7218b9467bed2d3fe6d
SSDEEP 1536:XMqXn1yAu1lEAXfXhfcV5TaSZ6CAxIFvIdy1Ni9/kfIbH5OnM:B1w1uAJfcySZ6CAxIFvIFNT5Z
TLSH
T152637C95A6494092E92382B5C4A34F83F9B1F3521711ABDFA2A8C18D2F237C38777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_socket.pyd
Size 84KB
SHA256 ba944001aa6b53350f8c64e93643742abf1a08dd07c7dbbc13996e7d4d8a9efa
MD5 a40238c4b5c9821defaef7cbf70574c3
SHA1 cd478ef13743ff1fb0bdea95a5260b38e6fd0ae0
SHA512 abe79ecd594a1366de25e05f3be81f5a0da7616fb5d0481bf5cda156e55212680a6e9fb1966cde3ca470737e2d56dc167108b08aca8f314fa48ca38283895187
SSDEEP 1536:3Fl/fFBFu9aBvtgYKyNEyJw7QlyJ+i+nzmQwLvxtq388ZlIFywvy1Ni9JfIYbQ:3FR1u9mvPEyJw7QlyJL+nzmQSvxSxlII
TLSH
T1CE836B01A66040F6EB73C075C2639E63FB74B1C01395A75F0466C55A2F33782AF7AA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_ssl.pyd
Size 177KB
SHA256 1cf939510359f5aa3c5f51a0ad994d9b819f5603dd100872cd30a1e25cd83f05
MD5 d41518f976563868b1626afd2eafb825
SHA1 2d1189562e4d37949d8b254ee3b94825d3787e29
SHA512 f9e1284720bd98e9e53feb2f2d16a0b86a6ddef4245789a9593e3e0bf230595577f1509f9050fae26619850661c6f5892ca5d33429b92efc6976565dd47bb98e
SSDEEP 3072:L9fZJvjN6U2kGMlfV6Cv/1UOmI7IM/cbPuC/Je5IFL7Oa5:L9xJrEU2tqV6CvqOss05
TLSH
T1AB048C47B5945AF7D813E4F9C1234903EBB0F155331247DE48D6E64A0F03B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_uuid.pyd
Size 27KB
SHA256 e196b2a878b8a57976e9ab5d7610e35a85e2fe3043fd3952934a54b415bd2854
MD5 8339c4c57827e3a294b9f711652ee4a3
SHA1 f940f35834b04c9896c7f2cad36ff6443fc3cb54
SHA512 bc35fdcaf87d3135863e41dbbe97c454dd8b6eeda9297ce3bd051b70ab7384bbafbe7fb24138aa5a1001b7b53565b1291c90e602f41d1244eacbd6e41a274a6e
SSDEEP 768:1TNg5n5IF0w2y1KPuBL2Ip40zTxf1mlRaX1Cbel:1xg5n5IF0w2y1Ni9MfIY1ll
TLSH
T12BC26DCA9A748043FE5396B0C1F6DE83B939BBD35911976B317591860E133C1A31B36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_wmi.pyd
Size 38KB
SHA256 ca38a50c27413a5acfd14b30b0433fcf80a64ad0020e41aceeb3666f8439aba4
MD5 39bf31877dd6b64700451021a91cd32e
SHA1 dca8e58dfe221c74f22c8bf56871e49a4f187966
SHA512 340765268b60520f6cf72cd37e6e9b5d1f728448ce2fd29427823f2bbb9630ee6894799c68744cf5bf65685772ba8b514e7735b76a298b94f5fc557513cfee55
SSDEEP 768:Z2/EEqrVmjsuuD2cru5IFLi9y1KPuBL2Ip4ETxf1ml6Z+7UBFg58:UE9BEKD2cru5IFLi9y1Ni9YfILqq8
TLSH
T192037D86E6680082FA6BC674C5A5CE93F575F7D35B12838F326582590F233D1D73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\base_library.zip
Size 1.3MB
SHA256 706dadeb1f95af02b3538f4587d44817ac776ddd483401247e3d8cf1cff34984
MD5 d1211e846733bd95785c559bad33f0ae
SHA1 6b319f9b6e9d964f2321b5cb2c783c3073af521e
SHA512 9ec8d6e42a059bb8f20b145dabc853dd158d3e13a89a696afccd9c52707bbfbeaf6373bece7b700cdf71cc1b0e90dc91f1c2f16f05fd4f86d33d42bfae3c9500
SSDEEP 12288:p+i2cPPdxhYN7Yw3UKRtif6mwsEEuIva80201jwCVRDVoioSYFiW7WpAdjdTTftf:05cPPdxhYOwpGwAJ7WpAdZTSSuTxWF
TLSH
T1BC651982B9527553FF64F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\libcrypto-3.dll
Size 5.0MB
SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
MD5 6d0a1af0e9a539a749dd50add9c4c27b
SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
TLSH
T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\libssl-3.dll
Size 776KB
SHA256 28c395290279fa4f4f54a57b85cd66d853895f925fefb8f6fdebc0d8b1cdd07c
MD5 08ce4a95de930fd27157c67117f9a613
SHA1 286599acbf6695aba6ce0db02d70ce93d08d8ec7
SHA512 36df1092ad0c6474781e6a3a4f12bc6de57619628d76ff49cc98c53ea05f6b7a81f78b19c01ea188b8703f986527f23fc55725d4478656317da306e728e7fd18
SSDEEP 12288:0ZTYMn3pvH8hSil3nuZEV+sIP+US9dFe9XbI:tMn3pvH8Uil3uZEV+sIP+xFe9XbI
TLSH
T1A7F44CADB37C05DCD8B6C17986934623E3B6F4562330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\select.pyd
Size 32KB
SHA256 a208997eb871b5c7785eb9bcc6a22ba8c43262255b59a3394fbe9912f38b4692
MD5 9583139460ba3a40961b03c76f12450f
SHA1 70f4d1e8015a98972eb82d3012fea6826254ca7e
SHA512 19e4865a001ecaf6ca7815b7779238e39a58e87e55e479fb4e47baa8e0262e886f8fef64304e0692577464fa92173b81d1f5e4c12a3e0f3244ffe1f1913d84de
SSDEEP 768:/pX5TZnELTaPlIF9Gzy1KPuBL2Ip40LTxf1ml9dHi7LL:hX5T5E/aPlIF9Gzy1Ni90pfIbHinL
TLSH
T1C6E28D8A6B345087EA63C671C6A2DE83F939B3E34651869F31B991991E137C1A33B314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\unicodedata.pyd
Size 696KB
SHA256 7f8d28574732959cdb1188127fe3494c3618b602eede69c0a71846f0b5cc8a15
MD5 e812b4f088002142f39d1ec8cded9478
SHA1 44a5ef735de03a29384ce8797897fffc047298cc
SHA512 f4c848a024e62b302b9f2c3b985455d332cb24084809d8163667677b62ed3a4342b324774712443e91c65250ce7e448f28c21d1b3951ee116484eee881e60fd8
SSDEEP 12288:iegxeYedLI/X77mvfldCK1ihH32W3cnPSqrUgTNF:iegxeYeW7qNxq3cnPXTNF
TLSH
T13FE4F5D5BBCF8D26E68B363948E3710F5171C3B35F0A863AB2582361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download