951a2e467d337baedeb8bed5d1147c79882ddf553f06d21d74ba17cdfda6d222

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Size 61.7MB
Sample260805-22fd6ahn2s
SHA256 951a2e467d337baedeb8bed5d1147c79882ddf553f06d21d74ba17cdfda6d222
MD5 73ee4b5b610a715ca6d03badf2c516a3
SHA1 0ee0a4fd9c6a12a6fbfe81519a4ee5021883f70b
SHA512 76175edde7fa34aeb2cae61eb4bba88a3bbd62ebd4a28b382a4dd399385483f892d558a9375a8353d3a64b27ef56ec3a10104dbd8d3c93380d45157bd79a6943
SSDEEP 98304:Tuj9nmW2eUAAq4gm4mNSh6q+luaePvl8/bbJtF0gofLzXQQ7QfM3r/:qRnmW2s/m3xq9a2l8/QX9EfM3r/
TLSH
T13FE78216B74289CEE076A238944B8F51E336E9704A71933723B5735D1FFE38C8EA6149
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bfkW9q.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\pYefWZ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables containing artifacts associated with disabling Widnows Defender 2 IoCs

resource	yara_rule
behavioral1/memory/2472-673-0x0000000003AF0000-0x00000000042F7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2472-677-0x0000000003AF0000-0x00000000042F7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	xVCYoq.exe

Executes dropped EXE 3 IoCs

pid	Process
4048	xVCYoq.exe
1564	xVCYoq.exe
2472	bfkW9q.exe

Loads dropped DLL 3 IoCs

pid	Process
4048	xVCYoq.exe
1564	xVCYoq.exe
2472	bfkW9q.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\pYefWZ\\xVCYoq.exe\""	xVCYoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\bfkW9q\\bfkW9q.exe\""	bfkW9q.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
220	cmd.exe
1068	cmd.exe
3648	cmd.exe
4156	cmd.exe
2392	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	xVCYoq.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\bfkW9q	xVCYoq.exe
File created	C:\Program Files (x86)\bfkW9q\bfkW9q.exe	xVCYoq.exe
File created	C:\Program Files (x86)\bfkW9q\image.png	xVCYoq.exe
File opened for modification	C:\Program Files (x86)\bfkW9q\bfkW9q.exe	xVCYoq.exe
File opened for modification	C:\Program Files (x86)\bfkW9q\thumbs.db	xVCYoq.exe
File created	C:\Program Files (x86)\bfkW9q\XPSPLOG.dll	xVCYoq.exe
File created	C:\Program Files (x86)\bfkW9q\thumbs.db	xVCYoq.exe
File opened for modification	C:\Program Files (x86)\bfkW9q\XPSPLOG.dll	xVCYoq.exe
File opened for modification	C:\Program Files (x86)\bfkW9q\image.png	xVCYoq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3628	cmd.exe
2140	cmd.exe
4796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfkW9q.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xVCYoq.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2368	schtasks.exe
2628	schtasks.exe
4768	schtasks.exe
4776	schtasks.exe
5088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2440	2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe
4048	xVCYoq.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 1068	4048	xVCYoq.exe	96
PID 1068 wrote to memory of 2368	1068	cmd.exe	100
PID 4048 wrote to memory of 3648	4048	xVCYoq.exe	101
PID 1068 wrote to memory of 2956	1068	cmd.exe	104
PID 3648 wrote to memory of 2628	3648	cmd.exe	107
PID 1068 wrote to memory of 1184	1068	cmd.exe	108
PID 3648 wrote to memory of 2572	3648	cmd.exe	109
PID 4048 wrote to memory of 4156	4048	xVCYoq.exe	111
PID 3648 wrote to memory of 4340	3648	cmd.exe	113
PID 4156 wrote to memory of 4768	4156	cmd.exe	114
PID 4156 wrote to memory of 2052	4156	cmd.exe	115
PID 4048 wrote to memory of 2392	4048	xVCYoq.exe	116
PID 4156 wrote to memory of 3596	4156	cmd.exe	118
PID 4796 wrote to memory of 4576	4796	cmd.exe	119
PID 2392 wrote to memory of 4776	2392	cmd.exe	120
PID 2392 wrote to memory of 4600	2392	cmd.exe	121
PID 2392 wrote to memory of 4416	2392	cmd.exe	123
PID 3628 wrote to memory of 4140	3628	cmd.exe	125
PID 4048 wrote to memory of 220	4048	xVCYoq.exe	126
PID 220 wrote to memory of 5088	220	cmd.exe	128
PID 220 wrote to memory of 876	220	cmd.exe	129
PID 220 wrote to memory of 4764	220	cmd.exe	132
PID 2140 wrote to memory of 944	2140	cmd.exe	133
PID 4048 wrote to memory of 2472	4048	xVCYoq.exe	134

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bfkW9q.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_73ee4b5b610a715ca6d03badf2c516a3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2440

C:\Users\Public\pYefWZ\xVCYoq.exe
C:\Users\Public\pYefWZ\xVCYoq.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\pYefWZ\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\pYefWZ\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4768
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2052
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5088
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4764
- C:\Program Files (x86)\bfkW9q\bfkW9q.exe
  "C:\Program Files (x86)\bfkW9q\bfkW9q.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:2472

C:\Users\Public\pYefWZ\xVCYoq.exe
"C:\Users\Public\pYefWZ\xVCYoq.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\pYefWZ" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\pYefWZ" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4576

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2428

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4140

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:944

C:\Program Files (x86)\bfkW9q\bfkW9q.exe
"C:\Program Files (x86)\bfkW9q\bfkW9q.exe"
1⤵
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\bfkW9q\XPSPLOG.dll
Size 4.6MB
SHA256 41a0435e5142c5a235c868452bad795b59cf69d779a999c9cc13ed3c2b5d7e2f
MD5 4f9959037b3f3cb3052a2a0cd8e0897f
SHA1 4d7a128e93fdc8aa5de1d7d60d7006d03d0fee89
SHA512 758b69574f9ab16d6286a72932f6e8bb67f18273590d59cb463d75d5c6e7ee9d6afe3690e827ec0e972e1e9da9ab32a9af8dd2be631b680bbd5a33ac39a39e36
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyf:BMWKfU+BcUTHCCCfqCiUffnf
TLSH
T15F263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bfkW9q.exe

Path C:\Program Files (x86)\bfkW9q\bfkW9q.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\bfkW9q\image.png
Size 5.0MB
SHA256 83901990a66df18afc1665a89b23c6db7a83c42566e49f0438b927833521b1ff
MD5 e33fe6309429ba26e6145a3077c4ec5f
SHA1 f9236ce04b0afdb1c3b2d89195dc680fb8e584e2
SHA512 c06387ffa7e8398decebf0d846f312373f2a2ddeb740f3225c6ebdb647c74570ac24651565309c55c4bf7eeb6f9e84464fad69dd13f749ecb9ed3c8de3aeaf89
SSDEEP 98304:YqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:M/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T1D5363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\bfkW9q\thumbs.db
Size 358KB
SHA256 5cdd16f189ada78b66ab17e4d96e99baa247b650e2514c1f6501dfcf4b5f5686
MD5 c7d203aa03330d63d3ece34d3774cf1e
SHA1 91e56b9798978a7e4768c33ff34340a6b79ef75a
SHA512 512875f93b4a123827ad2f4c019810b9fac7fecdeb56cb7603fdd874034c9700c4289ebc86723835ec2b11593ea1e489b6eabb65d79cc78fe597eeb61c2f8899
SSDEEP 6144:AiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:H8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T17A74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\pYefWZ\UxEnhance64.dll
Size 3.1MB
SHA256 f16313d4efbe3c04d26f9ee8b502d39e38cc8bdcb4aa57ada61bcaaca89cae15
MD5 9d4fdc3dccc5ca95b947a6a22ee4c655
SHA1 c13b1639f350e4237e82339908bb27e574f4e1a5
SHA512 070d659bba401cbc863a44c5b7802246b4055617f43b4fa8291f89271de32530cfe91cc020e6d46efd807fa813663f0efd5c3ce7971e53809c1cab6c83d9bf04
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+C:P9m29xx3Tiqt06ox6+z2rNNrKoC
TLSH
T1C0E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\pYefWZ\adoresd.dat
Size 4.7MB
SHA256 4e72fd3e0597b680e2131b84d431b5daed15edddf8bd78ac05f32306b2036637
MD5 d5870a665a4358c38759661a4c6cbbd9
SHA1 8c6e0e317d6dc6ee74684536384b4efb245923f5
SHA512 da82d3f62a1a50aa14e8878225d1359ca693b5c65c94c8fd873f17b2eb084d213b5cc222d5f94b8e73d433a39e114cf7f6e290a52b8b93e2e44440709aa0ab77
SSDEEP 98304:xmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:ku1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1123633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\pYefWZ\msadox.tb
Size 8KB
SHA256 324afdc0353fb6c048ac9b9592bacb2160607448d3ff45d5fd85386dbc59e7ee
MD5 a367cd648614b2a2ce4e04979f0c0353
SHA1 aebd0989dc995b6c16439fb8e174fa452c718ae1
SHA512 94ac7b87cafbac4ad5fc41e360b2f0c3b0928b934b196a3c6e46d39f3a4dd3493a4ef58d67f07da55fb94fa83dc96e85e1d4c37b628b0f6745a9a40680af121f
SSDEEP 192:TqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:TsZqZOXQ3uqvR2Kfzp
TLSH
T162029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xVCYoq.exe

Path C:\Users\Public\pYefWZ\xVCYoq.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1564-582-0x000001F5F8FD0000-0x000001F5F9861000-memory.dmp

Download

memory/1564-574-0x00007FFA6FF80000-0x00007FFA6FF82000-memory.dmp

Download

memory/1564-580-0x000001F5F8FD0000-0x000001F5F9861000-memory.dmp

Download

memory/1564-575-0x000001F5F8FD0000-0x000001F5F9861000-memory.dmp

Download

memory/1564-579-0x000001F5F8FD0000-0x000001F5F9861000-memory.dmp

Download

memory/1564-572-0x000001F5F8FD0000-0x000001F5F9861000-memory.dmp

Download

memory/1564-569-0x00007FFA53BA0000-0x00007FFA540BE000-memory.dmp

Download

memory/1564-581-0x000001F5F8FD0000-0x000001F5F9861000-memory.dmp

Download

memory/1564-583-0x00007FFA6FF70000-0x00007FFA6FF72000-memory.dmp

Download

memory/2440-0-0x00000000001E0000-0x00000000001ED000-memory.dmp

Download

memory/2440-523-0x00000000001E0000-0x00000000001ED000-memory.dmp

Download

memory/2440-503-0x00007FFA60F10000-0x00007FFA60F20000-memory.dmp

Download

memory/2440-1-0x00000000001F0000-0x00000000001FB000-memory.dmp

Download

memory/2440-524-0x00007FFA60F10000-0x00007FFA60F20000-memory.dmp

Download

memory/2472-684-0x0000000004390000-0x00000000043A4000-memory.dmp

Download

memory/2472-665-0x00000000013A0000-0x00000000013A1000-memory.dmp

Download

memory/2472-666-0x0000000075430000-0x0000000075B7A000-memory.dmp

Download

memory/2472-670-0x0000000003AF0000-0x00000000042F7000-memory.dmp

Download

memory/2472-672-0x00000000013C0000-0x00000000013C1000-memory.dmp

Download

memory/2472-673-0x0000000003AF0000-0x00000000042F7000-memory.dmp

Download

memory/2472-677-0x0000000003AF0000-0x00000000042F7000-memory.dmp

Download

memory/4048-535-0x000001B8024A0000-0x000001B802D31000-memory.dmp

Download

memory/4048-564-0x000001B8024A0000-0x000001B802D31000-memory.dmp

Download

memory/4048-563-0x000001B8024A0000-0x000001B802D31000-memory.dmp

Download

memory/4048-554-0x000001B802D40000-0x000001B802D8E000-memory.dmp

Download

memory/4048-555-0x000001B8031B0000-0x000001B80323A000-memory.dmp

Download

memory/4048-557-0x000001B8031B0000-0x000001B80323A000-memory.dmp

Download

memory/4048-558-0x000001B8031B0000-0x000001B80323A000-memory.dmp

Download

memory/4048-556-0x000001B8031B0000-0x000001B80323A000-memory.dmp

Download

memory/4048-549-0x000001B8024A0000-0x000001B802D31000-memory.dmp

Download

memory/4048-544-0x000001B8024A0000-0x000001B802D31000-memory.dmp

Download

memory/4048-545-0x000001B8024A0000-0x000001B802D31000-memory.dmp

Download

memory/4048-538-0x000001B8024A0000-0x000001B802D31000-memory.dmp

Download

memory/4048-543-0x000001B8024A0000-0x000001B802D31000-memory.dmp

Download

memory/4048-542-0x000001B8024A0000-0x000001B802D31000-memory.dmp

Download

memory/4048-537-0x00007FFA6FF80000-0x00007FFA6FF82000-memory.dmp

Download

memory/4048-529-0x00007FFA6FF70000-0x00007FFA6FF72000-memory.dmp

Download

memory/4048-530-0x00007FFA53BA0000-0x00007FFA540BE000-memory.dmp

Download