skuld | 54981838588030121270c471c523ae39b47d0f4528683036721e04681588ddb2

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Size 15.3MB
Sample260807-w2xesa1fpg
SHA256 54981838588030121270c471c523ae39b47d0f4528683036721e04681588ddb2
MD5 7c202320568ee72972cd795d52b0dcfd
SHA1 448d611b14150e28b72b785781c75dfd21f11bdd
SHA512 d00589d8eb8cd20c9f5a0971c404aae6eb11970c0b68748717e69c40a59bd92387f9fe0de55d268c68e2a42fa5e4ea587333a8f71edb254486bce335bfe2367a
SSDEEP 196608:45+1CVyZ6jSvsWnvpTM0igKAokzikL9brT3VG1t:4+CzWvs+zV5rE1t
TLSH
T1CCF68C43ECB556E9C199917ACA669712BB703C884B3163D36B60F6346F33BD0AE78740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery skuld persistence privilege_escalation stealer

Malware Config

Signatures

Family: Skuld stealer
An info stealer written in Go lang.
stealer skuld

Detects SkuldStealer 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024414-4.dat	family_skuld

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024414-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024414-4.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024414-4.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024414-4.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024414-4.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024414-4.dat	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024414-4.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Executes dropped EXE 2 IoCs

pid	Process
5064	SecurityHealthSystray.exe
3796	SecurityHealthWatcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Watcher Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthWatcher.exe"	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4	api.ipify.org
13	ip-api.com
15	api.ipify.org
3	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3048	netsh.exe
640	netsh.exe
2324	netsh.exe
1020	netsh.exe
2268	netsh.exe
1860	netsh.exe

Detects videocard installed 1 TTPs 6 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4236	wmic.exe
4372	wmic.exe
4736	wmic.exe
1856	wmic.exe
1632	wmic.exe
2852	wmic.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	14	Go-http-client/1.1

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Token: SeIncreaseQuotaPrivilege	1992	wmic.exe
Token: SeSecurityPrivilege	1992	wmic.exe
Token: SeTakeOwnershipPrivilege	1992	wmic.exe
Token: SeLoadDriverPrivilege	1992	wmic.exe
Token: SeSystemProfilePrivilege	1992	wmic.exe
Token: SeSystemtimePrivilege	1992	wmic.exe
Token: SeProfSingleProcessPrivilege	1992	wmic.exe
Token: SeIncBasePriorityPrivilege	1992	wmic.exe
Token: SeCreatePagefilePrivilege	1992	wmic.exe
Token: SeBackupPrivilege	1992	wmic.exe
Token: SeRestorePrivilege	1992	wmic.exe
Token: SeShutdownPrivilege	1992	wmic.exe
Token: SeDebugPrivilege	1992	wmic.exe
Token: SeSystemEnvironmentPrivilege	1992	wmic.exe
Token: SeRemoteShutdownPrivilege	1992	wmic.exe
Token: SeUndockPrivilege	1992	wmic.exe
Token: SeManageVolumePrivilege	1992	wmic.exe
Token: 33	1992	wmic.exe
Token: 34	1992	wmic.exe
Token: 35	1992	wmic.exe
Token: 36	1992	wmic.exe
Token: SeIncreaseQuotaPrivilege	1992	wmic.exe
Token: SeSecurityPrivilege	1992	wmic.exe
Token: SeTakeOwnershipPrivilege	1992	wmic.exe
Token: SeLoadDriverPrivilege	1992	wmic.exe
Token: SeSystemProfilePrivilege	1992	wmic.exe
Token: SeSystemtimePrivilege	1992	wmic.exe
Token: SeProfSingleProcessPrivilege	1992	wmic.exe
Token: SeIncBasePriorityPrivilege	1992	wmic.exe
Token: SeCreatePagefilePrivilege	1992	wmic.exe
Token: SeBackupPrivilege	1992	wmic.exe
Token: SeRestorePrivilege	1992	wmic.exe
Token: SeShutdownPrivilege	1992	wmic.exe
Token: SeDebugPrivilege	1992	wmic.exe
Token: SeSystemEnvironmentPrivilege	1992	wmic.exe
Token: SeRemoteShutdownPrivilege	1992	wmic.exe
Token: SeUndockPrivilege	1992	wmic.exe
Token: SeManageVolumePrivilege	1992	wmic.exe
Token: 33	1992	wmic.exe
Token: 34	1992	wmic.exe
Token: 35	1992	wmic.exe
Token: 36	1992	wmic.exe
Token: SeIncreaseQuotaPrivilege	3520	wmic.exe
Token: SeSecurityPrivilege	3520	wmic.exe
Token: SeTakeOwnershipPrivilege	3520	wmic.exe
Token: SeLoadDriverPrivilege	3520	wmic.exe
Token: SeSystemProfilePrivilege	3520	wmic.exe
Token: SeSystemtimePrivilege	3520	wmic.exe
Token: SeProfSingleProcessPrivilege	3520	wmic.exe
Token: SeIncBasePriorityPrivilege	3520	wmic.exe
Token: SeCreatePagefilePrivilege	3520	wmic.exe
Token: SeBackupPrivilege	3520	wmic.exe
Token: SeRestorePrivilege	3520	wmic.exe
Token: SeShutdownPrivilege	3520	wmic.exe
Token: SeDebugPrivilege	3520	wmic.exe
Token: SeSystemEnvironmentPrivilege	3520	wmic.exe
Token: SeRemoteShutdownPrivilege	3520	wmic.exe
Token: SeUndockPrivilege	3520	wmic.exe
Token: SeManageVolumePrivilege	3520	wmic.exe
Token: 33	3520	wmic.exe
Token: 34	3520	wmic.exe
Token: 35	3520	wmic.exe
Token: 36	3520	wmic.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2836	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	85
PID 1908 wrote to memory of 1992	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	86
PID 1908 wrote to memory of 3520	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	88
PID 1908 wrote to memory of 3272	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	89
PID 1908 wrote to memory of 4736	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	90
PID 1908 wrote to memory of 1860	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	91
PID 1908 wrote to memory of 4856	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	92
PID 1908 wrote to memory of 4732	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	93
PID 1908 wrote to memory of 5064	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	96
PID 5064 wrote to memory of 5044	5064	SecurityHealthSystray.exe	97
PID 1908 wrote to memory of 3796	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	98
PID 5064 wrote to memory of 3560	5064	SecurityHealthSystray.exe	99
PID 1908 wrote to memory of 388	1908	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	100
PID 3796 wrote to memory of 3964	3796	SecurityHealthWatcher.exe	101
PID 5064 wrote to memory of 3416	5064	SecurityHealthSystray.exe	102
PID 5064 wrote to memory of 1464	5064	SecurityHealthSystray.exe	103
PID 5064 wrote to memory of 1856	5064	SecurityHealthSystray.exe	104
PID 5064 wrote to memory of 3048	5064	SecurityHealthSystray.exe	105
PID 5064 wrote to memory of 3912	5064	SecurityHealthSystray.exe	117
PID 5064 wrote to memory of 3116	5064	SecurityHealthSystray.exe	118
PID 5064 wrote to memory of 4140	5064	SecurityHealthSystray.exe	119
PID 5064 wrote to memory of 1632	5064	SecurityHealthSystray.exe	120
PID 5064 wrote to memory of 640	5064	SecurityHealthSystray.exe	121
PID 5064 wrote to memory of 1592	5064	SecurityHealthSystray.exe	122
PID 5064 wrote to memory of 1188	5064	SecurityHealthSystray.exe	123
PID 5064 wrote to memory of 1688	5064	SecurityHealthSystray.exe	124
PID 5064 wrote to memory of 2852	5064	SecurityHealthSystray.exe	125
PID 5064 wrote to memory of 2324	5064	SecurityHealthSystray.exe	126
PID 5064 wrote to memory of 3640	5064	SecurityHealthSystray.exe	127
PID 5064 wrote to memory of 4384	5064	SecurityHealthSystray.exe	128
PID 5064 wrote to memory of 376	5064	SecurityHealthSystray.exe	129
PID 5064 wrote to memory of 4236	5064	SecurityHealthSystray.exe	130
PID 5064 wrote to memory of 1020	5064	SecurityHealthSystray.exe	131
PID 5064 wrote to memory of 2300	5064	SecurityHealthSystray.exe	132
PID 5064 wrote to memory of 1400	5064	SecurityHealthSystray.exe	133
PID 5064 wrote to memory of 4120	5064	SecurityHealthSystray.exe	134
PID 5064 wrote to memory of 4372	5064	SecurityHealthSystray.exe	135
PID 5064 wrote to memory of 2268	5064	SecurityHealthSystray.exe	136

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4732	attrib.exe
5044	attrib.exe
3964	attrib.exe
2836	attrib.exe
4856	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:2836
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  PID:3272
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4736
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1860
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:4856
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  2⤵
  - Views/modifies file attributes
  PID:4732
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    3⤵
    - Views/modifies file attributes
    PID:5044
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3560
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:3416
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:1464
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1856
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3048
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3912
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:3116
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4140
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1632
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:640
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:1592
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:1188
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:1688
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2852
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2324
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3640
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:4384
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:376
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4236
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1020
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:2300
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:1400
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4120
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:4372
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2268
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
    3⤵
    - Views/modifies file attributes
    PID:3964
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 15.3MB
SHA256 54981838588030121270c471c523ae39b47d0f4528683036721e04681588ddb2
MD5 7c202320568ee72972cd795d52b0dcfd
SHA1 448d611b14150e28b72b785781c75dfd21f11bdd
SHA512 d00589d8eb8cd20c9f5a0971c404aae6eb11970c0b68748717e69c40a59bd92387f9fe0de55d268c68e2a42fa5e4ea587333a8f71edb254486bce335bfe2367a
SSDEEP 196608:45+1CVyZ6jSvsWnvpTM0igKAokzikL9brT3VG1t:4+CzWvs+zV5rE1t
TLSH
T1CCF68C43ECB556E9C199917ACA669712BB703C884B3163D36B60F6346F33BD0AE78740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads