skuld | 54981838588030121270c471c523ae39b47d0f4528683036721e04681588ddb2

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Size 15.3MB
Sample260807-w2xesa1fpg
SHA256 54981838588030121270c471c523ae39b47d0f4528683036721e04681588ddb2
MD5 7c202320568ee72972cd795d52b0dcfd
SHA1 448d611b14150e28b72b785781c75dfd21f11bdd
SHA512 d00589d8eb8cd20c9f5a0971c404aae6eb11970c0b68748717e69c40a59bd92387f9fe0de55d268c68e2a42fa5e4ea587333a8f71edb254486bce335bfe2367a
SSDEEP 196608:45+1CVyZ6jSvsWnvpTM0igKAokzikL9brT3VG1t:4+CzWvs+zV5rE1t
TLSH
T1CCF68C43ECB556E9C199917ACA669712BB703C884B3163D36B60F6346F33BD0AE78740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery skuld persistence privilege_escalation stealer

Malware Config

Signatures

Family: Skuld stealer
An info stealer written in Go lang.
stealer skuld

Detects SkuldStealer 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c3bd-4.dat	family_skuld

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c3bd-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c3bd-4.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c3bd-4.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c3bd-4.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c3bd-4.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c3bd-4.dat	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c3bd-4.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Executes dropped EXE 4 IoCs

pid	Process
3516	SecurityHealthSystray.exe
2968	SecurityHealthSystray.exe
360	SecurityHealthWatcher.exe
260	SecurityHealthWatcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Watcher Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthWatcher.exe"	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
3	api.ipify.org
8	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4140	netsh.exe
3428	netsh.exe
5004	netsh.exe
1200	netsh.exe
3464	netsh.exe
1660	netsh.exe

Detects videocard installed 1 TTPs 6 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4328	wmic.exe
1092	wmic.exe
6132	wmic.exe
2772	wmic.exe
5532	wmic.exe
2776	wmic.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1
HTTP User-Agent header	7	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4472	wmic.exe
4472	wmic.exe
4472	wmic.exe
4472	wmic.exe
3396	wmic.exe
3396	wmic.exe
3396	wmic.exe
3396	wmic.exe
936	wmic.exe
936	wmic.exe
936	wmic.exe
936	wmic.exe
4328	wmic.exe
4328	wmic.exe
4328	wmic.exe
4328	wmic.exe
3576	wmic.exe
3576	wmic.exe
3576	wmic.exe
3576	wmic.exe
1488	wmic.exe
1488	wmic.exe
1488	wmic.exe
1488	wmic.exe
4664	wmic.exe
4664	wmic.exe
4664	wmic.exe
4664	wmic.exe
1092	wmic.exe
1092	wmic.exe
1092	wmic.exe
1092	wmic.exe
4208	wmic.exe
4208	wmic.exe
4208	wmic.exe
4208	wmic.exe
6096	wmic.exe
6096	wmic.exe
6096	wmic.exe
6096	wmic.exe
5620	wmic.exe
5620	wmic.exe
5620	wmic.exe
5620	wmic.exe
2552	wmic.exe
2552	wmic.exe
2552	wmic.exe
2552	wmic.exe
6132	wmic.exe
6132	wmic.exe
6132	wmic.exe
6132	wmic.exe
3720	wmic.exe
3720	wmic.exe
3720	wmic.exe
3720	wmic.exe
5644	wmic.exe
5644	wmic.exe
5644	wmic.exe
5644	wmic.exe
3440	wmic.exe
3440	wmic.exe
3440	wmic.exe
3440	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Token: SeIncreaseQuotaPrivilege	4472	wmic.exe
Token: SeSecurityPrivilege	4472	wmic.exe
Token: SeTakeOwnershipPrivilege	4472	wmic.exe
Token: SeLoadDriverPrivilege	4472	wmic.exe
Token: SeSystemProfilePrivilege	4472	wmic.exe
Token: SeSystemtimePrivilege	4472	wmic.exe
Token: SeProfSingleProcessPrivilege	4472	wmic.exe
Token: SeIncBasePriorityPrivilege	4472	wmic.exe
Token: SeCreatePagefilePrivilege	4472	wmic.exe
Token: SeBackupPrivilege	4472	wmic.exe
Token: SeRestorePrivilege	4472	wmic.exe
Token: SeShutdownPrivilege	4472	wmic.exe
Token: SeDebugPrivilege	4472	wmic.exe
Token: SeSystemEnvironmentPrivilege	4472	wmic.exe
Token: SeRemoteShutdownPrivilege	4472	wmic.exe
Token: SeUndockPrivilege	4472	wmic.exe
Token: SeManageVolumePrivilege	4472	wmic.exe
Token: 33	4472	wmic.exe
Token: 34	4472	wmic.exe
Token: 35	4472	wmic.exe
Token: 36	4472	wmic.exe
Token: SeIncreaseQuotaPrivilege	4472	wmic.exe
Token: SeSecurityPrivilege	4472	wmic.exe
Token: SeTakeOwnershipPrivilege	4472	wmic.exe
Token: SeLoadDriverPrivilege	4472	wmic.exe
Token: SeSystemProfilePrivilege	4472	wmic.exe
Token: SeSystemtimePrivilege	4472	wmic.exe
Token: SeProfSingleProcessPrivilege	4472	wmic.exe
Token: SeIncBasePriorityPrivilege	4472	wmic.exe
Token: SeCreatePagefilePrivilege	4472	wmic.exe
Token: SeBackupPrivilege	4472	wmic.exe
Token: SeRestorePrivilege	4472	wmic.exe
Token: SeShutdownPrivilege	4472	wmic.exe
Token: SeDebugPrivilege	4472	wmic.exe
Token: SeSystemEnvironmentPrivilege	4472	wmic.exe
Token: SeRemoteShutdownPrivilege	4472	wmic.exe
Token: SeUndockPrivilege	4472	wmic.exe
Token: SeManageVolumePrivilege	4472	wmic.exe
Token: 33	4472	wmic.exe
Token: 34	4472	wmic.exe
Token: 35	4472	wmic.exe
Token: 36	4472	wmic.exe
Token: SeIncreaseQuotaPrivilege	3396	wmic.exe
Token: SeSecurityPrivilege	3396	wmic.exe
Token: SeTakeOwnershipPrivilege	3396	wmic.exe
Token: SeLoadDriverPrivilege	3396	wmic.exe
Token: SeSystemProfilePrivilege	3396	wmic.exe
Token: SeSystemtimePrivilege	3396	wmic.exe
Token: SeProfSingleProcessPrivilege	3396	wmic.exe
Token: SeIncBasePriorityPrivilege	3396	wmic.exe
Token: SeCreatePagefilePrivilege	3396	wmic.exe
Token: SeBackupPrivilege	3396	wmic.exe
Token: SeRestorePrivilege	3396	wmic.exe
Token: SeShutdownPrivilege	3396	wmic.exe
Token: SeDebugPrivilege	3396	wmic.exe
Token: SeSystemEnvironmentPrivilege	3396	wmic.exe
Token: SeRemoteShutdownPrivilege	3396	wmic.exe
Token: SeUndockPrivilege	3396	wmic.exe
Token: SeManageVolumePrivilege	3396	wmic.exe
Token: 33	3396	wmic.exe
Token: 34	3396	wmic.exe
Token: 35	3396	wmic.exe
Token: 36	3396	wmic.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 5128	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	90
PID 4132 wrote to memory of 4472	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	91
PID 4132 wrote to memory of 3396	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	93
PID 4132 wrote to memory of 936	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	94
PID 4132 wrote to memory of 4328	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	95
PID 4132 wrote to memory of 4140	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	96
PID 4132 wrote to memory of 4492	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	97
PID 4132 wrote to memory of 4912	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	99
PID 4132 wrote to memory of 2968	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	102
PID 2968 wrote to memory of 4436	2968	SecurityHealthSystray.exe	103
PID 2968 wrote to memory of 3576	2968	SecurityHealthSystray.exe	104
PID 2968 wrote to memory of 1488	2968	SecurityHealthSystray.exe	105
PID 2968 wrote to memory of 4664	2968	SecurityHealthSystray.exe	106
PID 2968 wrote to memory of 1092	2968	SecurityHealthSystray.exe	107
PID 4132 wrote to memory of 260	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	109
PID 260 wrote to memory of 2812	260	SecurityHealthWatcher.exe	110
PID 4132 wrote to memory of 4208	4132	2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	111
PID 2968 wrote to memory of 3428	2968	SecurityHealthSystray.exe	112
PID 2968 wrote to memory of 6096	2968	SecurityHealthSystray.exe	114
PID 2968 wrote to memory of 5620	2968	SecurityHealthSystray.exe	115
PID 2968 wrote to memory of 2552	2968	SecurityHealthSystray.exe	116
PID 2968 wrote to memory of 6132	2968	SecurityHealthSystray.exe	117
PID 2968 wrote to memory of 5004	2968	SecurityHealthSystray.exe	118
PID 2968 wrote to memory of 3720	2968	SecurityHealthSystray.exe	119
PID 2968 wrote to memory of 5644	2968	SecurityHealthSystray.exe	120
PID 2968 wrote to memory of 3440	2968	SecurityHealthSystray.exe	121
PID 2968 wrote to memory of 2772	2968	SecurityHealthSystray.exe	122
PID 2968 wrote to memory of 1200	2968	SecurityHealthSystray.exe	123
PID 2968 wrote to memory of 5144	2968	SecurityHealthSystray.exe	124
PID 2968 wrote to memory of 2748	2968	SecurityHealthSystray.exe	125
PID 2968 wrote to memory of 4832	2968	SecurityHealthSystray.exe	126
PID 2968 wrote to memory of 5532	2968	SecurityHealthSystray.exe	127
PID 2968 wrote to memory of 3464	2968	SecurityHealthSystray.exe	128
PID 2968 wrote to memory of 3792	2968	SecurityHealthSystray.exe	129
PID 2968 wrote to memory of 2856	2968	SecurityHealthSystray.exe	130
PID 2968 wrote to memory of 4276	2968	SecurityHealthSystray.exe	131
PID 2968 wrote to memory of 2776	2968	SecurityHealthSystray.exe	132
PID 2968 wrote to memory of 1660	2968	SecurityHealthSystray.exe	133

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2812	attrib.exe
5128	attrib.exe
4492	attrib.exe
4912	attrib.exe
4436	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:5128
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4472
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4140
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:4492
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  2⤵
  - Views/modifies file attributes
  PID:4912
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    3⤵
    - Views/modifies file attributes
    PID:4436
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3576
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1488
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4664
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:1092
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3428
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6096
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5620
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2552
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:6132
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5004
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3720
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5644
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3440
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2772
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1200
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:5144
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:2748
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4832
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:5532
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3464
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:3792
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    PID:2856
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:4276
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2776
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1660
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
    3⤵
    - Views/modifies file attributes
    PID:2812
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:3516

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthWatcher.exe
1⤵
- Executes dropped EXE
PID:360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 15.3MB
SHA256 54981838588030121270c471c523ae39b47d0f4528683036721e04681588ddb2
MD5 7c202320568ee72972cd795d52b0dcfd
SHA1 448d611b14150e28b72b785781c75dfd21f11bdd
SHA512 d00589d8eb8cd20c9f5a0971c404aae6eb11970c0b68748717e69c40a59bd92387f9fe0de55d268c68e2a42fa5e4ea587333a8f71edb254486bce335bfe2367a
SSDEEP 196608:45+1CVyZ6jSvsWnvpTM0igKAokzikL9brT3VG1t:4+CzWvs+zV5rE1t
TLSH
T1CCF68C43ECB556E9C199917ACA669712BB703C884B3163D36B60F6346F33BD0AE78740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download