d918cb642f079def30a5c9c3aa003820aabc1bd839cdd201c9db903ca47a2b89

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_78f251836f53109ee8ea74f76150b45c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
Size 40.7MB
Sample260813-a72qsswzhy
SHA256 d918cb642f079def30a5c9c3aa003820aabc1bd839cdd201c9db903ca47a2b89
MD5 78f251836f53109ee8ea74f76150b45c
SHA1 440e0939bbc343e7082b10f87992eaf3c814bff8
SHA512 9fe311fc2b7d2d0963f55f2fa2842a09ab14c966c875ff2d1c4b2843a471c73a6f58b83a926dc57336e351940bbee6ae2644d878a41480a22a9147bff827c158
SSDEEP 393216:G6F3TI9E/wpw2/pblsj7KfEfJInv3lMz5/oZxGsnxylfyYr8BUkpcI4XXr3/hIxs:G9HlkOm6sXdIxO1MiR
TLSH
T118977B0673E601A5E9B3D2388AAB5107D773B8625730CBDF325D06552FBB6D09A3B720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion

Malware Config

Signatures

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5468	reg.exe
3392	reg.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4780	powershell.exe
4780	powershell.exe
1168	powershell.exe
1168	powershell.exe
1020	powershell.exe
1020	powershell.exe
1020	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeIncreaseQuotaPrivilege	1168	powershell.exe
Token: SeSecurityPrivilege	1168	powershell.exe
Token: SeTakeOwnershipPrivilege	1168	powershell.exe
Token: SeLoadDriverPrivilege	1168	powershell.exe
Token: SeSystemProfilePrivilege	1168	powershell.exe
Token: SeSystemtimePrivilege	1168	powershell.exe
Token: SeProfSingleProcessPrivilege	1168	powershell.exe
Token: SeIncBasePriorityPrivilege	1168	powershell.exe
Token: SeCreatePagefilePrivilege	1168	powershell.exe
Token: SeBackupPrivilege	1168	powershell.exe
Token: SeRestorePrivilege	1168	powershell.exe
Token: SeShutdownPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeSystemEnvironmentPrivilege	1168	powershell.exe
Token: SeRemoteShutdownPrivilege	1168	powershell.exe
Token: SeUndockPrivilege	1168	powershell.exe
Token: SeManageVolumePrivilege	1168	powershell.exe
Token: 33	1168	powershell.exe
Token: 34	1168	powershell.exe
Token: 35	1168	powershell.exe
Token: 36	1168	powershell.exe
Token: SeIncreaseQuotaPrivilege	1168	powershell.exe
Token: SeSecurityPrivilege	1168	powershell.exe
Token: SeTakeOwnershipPrivilege	1168	powershell.exe
Token: SeLoadDriverPrivilege	1168	powershell.exe
Token: SeSystemProfilePrivilege	1168	powershell.exe
Token: SeSystemtimePrivilege	1168	powershell.exe
Token: SeProfSingleProcessPrivilege	1168	powershell.exe
Token: SeIncBasePriorityPrivilege	1168	powershell.exe
Token: SeCreatePagefilePrivilege	1168	powershell.exe
Token: SeBackupPrivilege	1168	powershell.exe
Token: SeRestorePrivilege	1168	powershell.exe
Token: SeShutdownPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeSystemEnvironmentPrivilege	1168	powershell.exe
Token: SeRemoteShutdownPrivilege	1168	powershell.exe
Token: SeUndockPrivilege	1168	powershell.exe
Token: SeManageVolumePrivilege	1168	powershell.exe
Token: 33	1168	powershell.exe
Token: 34	1168	powershell.exe
Token: 35	1168	powershell.exe
Token: 36	1168	powershell.exe
Token: SeIncreaseQuotaPrivilege	1168	powershell.exe
Token: SeSecurityPrivilege	1168	powershell.exe
Token: SeTakeOwnershipPrivilege	1168	powershell.exe
Token: SeLoadDriverPrivilege	1168	powershell.exe
Token: SeSystemProfilePrivilege	1168	powershell.exe
Token: SeSystemtimePrivilege	1168	powershell.exe
Token: SeProfSingleProcessPrivilege	1168	powershell.exe
Token: SeIncBasePriorityPrivilege	1168	powershell.exe
Token: SeCreatePagefilePrivilege	1168	powershell.exe
Token: SeBackupPrivilege	1168	powershell.exe
Token: SeRestorePrivilege	1168	powershell.exe
Token: SeShutdownPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeSystemEnvironmentPrivilege	1168	powershell.exe
Token: SeRemoteShutdownPrivilege	1168	powershell.exe
Token: SeUndockPrivilege	1168	powershell.exe
Token: SeManageVolumePrivilege	1168	powershell.exe
Token: 33	1168	powershell.exe
Token: 34	1168	powershell.exe
Token: 35	1168	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4780	4324	2026-08-12_78f251836f53109ee8ea74f76150b45c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe	89
PID 4324 wrote to memory of 1168	4324	2026-08-12_78f251836f53109ee8ea74f76150b45c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe	92
PID 4324 wrote to memory of 5468	4324	2026-08-12_78f251836f53109ee8ea74f76150b45c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe	95
PID 4324 wrote to memory of 3392	4324	2026-08-12_78f251836f53109ee8ea74f76150b45c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe	97
PID 4324 wrote to memory of 1020	4324	2026-08-12_78f251836f53109ee8ea74f76150b45c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-12_78f251836f53109ee8ea74f76150b45c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_78f251836f53109ee8ea74f76150b45c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAHMAaABlAGwAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwACgAkAGQAZQBzAGsAdABvAHAAIAA9ACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0ACsAUwBwAGUAYwBpAGEAbABGAG8AbABkAGUAcgBdADoAOgBEAGUAcwBrAHQAbwBwAEQAaQByAGUAYwB0AG8AcgB5ACkACgAkAGwAaQBuAGsAIAA9ACAAJABzAGgAZQBsAGwALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABkAGUAcwBrAHQAbwBwACAAJwBBAGwAZwBvACAAUABhAG4AZQBsAC4AbABuAGsAJwApACkACgAkAGwAaQBuAGsALgBUAGEAcgBnAGUAdABQAGEAdABoACAAPQAgACQAZQBuAHYAOgBBAEwARwBPAF8ARQBYAEUACgAkAGwAaQBuAGsALgBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBMAEcATwBfAEUAWABFAAoAJABsAGkAbgBrAC4ASQBjAG8AbgBMAG8AYwBhAHQAaQBvAG4AIAA9ACAAJABlAG4AdgA6AEEATABHAE8AXwBFAFgARQAgACsAIAAnACwAMAAnAAoAJABsAGkAbgBrAC4ARABlAHMAYwByAGkAcAB0AGkAbwBuACAAPQAgACcAQQBsAGcAbwAgAFAAYQBuAGUAbAAnAAoAJABsAGkAbgBrAC4AUwBhAHYAZQAoACkACgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABtAGEAYwBzACAAPQAgAEAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAE4AZQB0AHcAbwByAGsAQQBkAGEAcAB0AGUAcgAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBQAGgAeQBzAGkAYwBhAGwAQQBkAGEAcAB0AGUAcgAgAC0AZQBxACAAJAB0AHIAdQBlACAALQBhAG4AZAAgACQAXwAuAE0AQQBDAEEAZABkAHIAZQBzAHMAIAB9ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAoACQAXwAuAE0AQQBDAEEAZABkAHIAZQBzAHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAnAFsAXgAwAC0AOQBBAC0ARgBhAC0AZgBdACcALAAgACcAJwApAC4AVABvAFUAcABwAGUAcgBJAG4AdgBhAHIAaQBhAG4AdAAoACkAIAB9ACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAC0AVQBuAGkAcQB1AGUAKQAKACQAYgBpAG8AcwAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQgBJAE8AUwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgApAAoAJABiAG8AYQByAGQAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAEIAYQBzAGUAQgBvAGEAcgBkACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAIAAtAEUAeABwAGEAbgBkAFAAcgBvAHAAZQByAHQAeQAgAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByACkACgBAAHsAIABtAGEAYwBzACAAPQAgACQAbQBhAGMAcwA7ACAAYgBpAG8AcwAgAD0AIABbAFMAdAByAGkAbgBnAF0AJABiAGkAbwBzADsAIABiAG8AYQByAGQAIAA9ACAAWwBTAHQAcgBpAG4AZwBdACQAYgBvAGEAcgBkACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAKAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\system32\reg.exe
  reg.exe QUERY HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5468
- C:\Windows\system32\reg.exe
  reg.exe QUERY HKCU\Software\AlgoPanel /v LicenseStateV2
  2⤵
  - Modifies registry key
  PID:3392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUAByAGUAcwBlAG4AdABhAHQAaQBvAG4ARgByAGEAbQBlAHcAbwByAGsACgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAKACQAZABlAHYAaQBjAGUAQwBvAGQAZQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGUAbgB2ADoAQQBMAEcATwBfAEQARQBWAEkAQwBFACkAKQAKACQAbQBlAHMAcwBhAGcAZQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGUAbgB2ADoAQQBMAEcATwBfAE0ARQBTAFMAQQBHAEUAKQApAAoAWwB4AG0AbABdACQAeABhAG0AbAAgAD0AIABAACcACgA8AFcAaQBuAGQAbwB3ACAAeABtAGwAbgBzAD0AIgBoAHQAdABwADoALwAvAHMAYwBoAGUAbQBhAHMALgBtAGkAYwByAG8AcwBvAGYAdAAuAGMAbwBtAC8AdwBpAG4AZgB4AC8AMgAwADAANgAvAHgAYQBtAGwALwBwAHIAZQBzAGUAbgB0AGEAdABpAG8AbgAiACAAVABpAHQAbABlAD0AIgBBAGwAZwBvACAAUABhAG4AZQBsACAAQQBrAHQAaQB2AGEAcwB5AG8AbgAiACAAVwBpAGQAdABoAD0AIgA1ADkAMAAiACAASABlAGkAZwBoAHQAPQAiADYAMAAwACIAIABXAGkAbgBkAG8AdwBTAHQAYQByAHQAdQBwAEwAbwBjAGEAdABpAG8AbgA9ACIAQwBlAG4AdABlAHIAUwBjAHIAZQBlAG4AIgAgAFIAZQBzAGkAegBlAE0AbwBkAGUAPQAiAE4AbwBSAGUAcwBpAHoAZQAiACAAQgBhAGMAawBnAHIAbwB1AG4AZAA9ACIAIwAwAEIAMABFADEANgAiACAARgBvAHIAZQBnAHIAbwB1AG4AZAA9ACIAIwBGADcARgA4AEYAQwAiACAARgBvAG4AdABGAGEAbQBpAGwAeQA9ACIAUwBlAGcAbwBlACAAVQBJACIAPgAKACAAIAA8AFcAaQBuAGQAbwB3AC4AUgBlAHMAbwB1AHIAYwBlAHMAPgAKACAAIAAgACAAPABTAHQAeQBsAGUAIABUAGEAcgBnAGUAdABUAHkAcABlAD0AIgBUAGUAeAB0AEIAbwB4ACIAPgA8AFMAZQB0AHQAZQByACAAUAByAG8AcABlAHIAdAB5AD0AIgBCAGEAYwBrAGcAcgBvAHUAbgBkACIAIABWAGEAbAB1AGUAPQAiACMAMQAyADEANwAyADUAIgAvAD4APABTAGUAdAB0AGUAcgAgAFAAcgBvAHAAZQByAHQAeQA9ACIARgBvAHIAZQBnAHIAbwB1AG4AZAAiACAAVgBhAGwAdQBlAD0AIgAjAEYANwBGADgARgBDACIALwA+ADwAUwBlAHQAdABlAHIAIABQAHIAbwBwAGUAcgB0AHkAPQAiAEIAbwByAGQAZQByAEIAcgB1AHMAaAAiACAAVgBhAGwAdQBlAD0AIgAjADIAOQAzADEANAA5ACIALwA+ADwAUwBlAHQAdABlAHIAIABQAHIAbwBwAGUAcgB0AHkAPQAiAEIAbwByAGQAZQByAFQAaABpAGMAawBuAGUAcwBzACIAIABWAGEAbAB1AGUAPQAiADEAIgAvAD4APABTAGUAdAB0AGUAcgAgAFAAcgBvAHAAZQByAHQAeQA9ACIAUABhAGQAZABpAG4AZwAiACAAVgBhAGwAdQBlAD0AIgAxADMAIgAvAD4APABTAGUAdAB0AGUAcgAgAFAAcgBvAHAAZQByAHQAeQA9ACIARgBvAG4AdABTAGkAegBlACIAIABWAGEAbAB1AGUAPQAiADEAMwAiAC8APgA8AC8AUwB0AHkAbABlAD4ACgAgACAAIAAgADwAUwB0AHkAbABlACAAVABhAHIAZwBlAHQAVAB5AHAAZQA9ACIAQgB1AHQAdABvAG4AIgA+ADwAUwBlAHQAdABlAHIAIABQAHIAbwBwAGUAcgB0AHkAPQAiAEMAdQByAHMAbwByACIAIABWAGEAbAB1AGUAPQAiAEgAYQBuAGQAIgAvAD4APABTAGUAdAB0AGUAcgAgAFAAcgBvAHAAZQByAHQAeQA9ACIAUABhAGQAZABpAG4AZwAiACAAVgBhAGwAdQBlAD0AIgAxADcALAAxADEAIgAvAD4APABTAGUAdAB0AGUAcgAgAFAAcgBvAHAAZQByAHQAeQA9ACIARgBvAG4AdABXAGUAaQBnAGgAdAAiACAAVgBhAGwAdQBlAD0AIgBTAGUAbQBpAEIAbwBsAGQAIgAvAD4APABTAGUAdAB0AGUAcgAgAFAAcgBvAHAAZQByAHQAeQA9ACIAQgBvAHIAZABlAHIAVABoAGkAYwBrAG4AZQBzAHMAIgAgAFYAYQBsAHUAZQA9ACIAMAAiAC8APgA8AC8AUwB0AHkAbABlAD4ACgAgACAAPAAvAFcAaQBuAGQAbwB3AC4AUgBlAHMAbwB1AHIAYwBlAHMAPgAKACAAIAA8AEcAcgBpAGQAIABNAGEAcgBnAGkAbgA9ACIAMwA2ACIAPgAKACAAIAAgACAAPABHAHIAaQBkAC4AUgBvAHcARABlAGYAaQBuAGkAdABpAG8AbgBzAD4APABSAG8AdwBEAGUAZgBpAG4AaQB0AGkAbwBuACAASABlAGkAZwBoAHQAPQAiAEEAdQB0AG8AIgAvAD4APABSAG8AdwBEAGUAZgBpAG4AaQB0AGkAbwBuACAASABlAGkAZwBoAHQAPQAiAEEAdQB0AG8AIgAvAD4APABSAG8AdwBEAGUAZgBpAG4AaQB0AGkAbwBuACAASABlAGkAZwBoAHQAPQAiAEEAdQB0AG8AIgAvAD4APABSAG8AdwBEAGUAZgBpAG4AaQB0AGkAbwBuACAASABlAGkAZwBoAHQAPQAiAEEAdQB0AG8AIgAvAD4APABSAG8AdwBEAGUAZgBpAG4AaQB0AGkAbwBuACAASABlAGkAZwBoAHQAPQAiAEEAdQB0AG8AIgAvAD4APABSAG8AdwBEAGUAZgBpAG4AaQB0AGkAbwBuACAASABlAGkAZwBoAHQAPQAiACoAIgAvAD4APABSAG8AdwBEAGUAZgBpAG4AaQB0AGkAbwBuACAASABlAGkAZwBoAHQAPQAiAEEAdQB0AG8AIgAvAD4APAAvAEcAcgBpAGQALgBSAG8AdwBEAGUAZgBpAG4AaQB0AGkAbwBuAHMAPgAKACAAIAAgACAAPABTAHQAYQBjAGsAUABhAG4AZQBsACAARwByAGkAZAAuAFIAbwB3AD0AIgAwACIAIABPAHIAaQBlAG4AdABhAHQAaQBvAG4APQAiAEgAbwByAGkAegBvAG4AdABhAGwAIgAgAE0AYQByAGcAaQBuAD0AIgAwACwAMAAsADAALAAyADIAIgA+ADwAQgBvAHIAZABlAHIAIABXAGkAZAB0AGgAPQAiADUANAAiACAASABlAGkAZwBoAHQAPQAiADUANAAiACAAQwBvAHIAbgBlAHIAUgBhAGQAaQB1AHMAPQAiADEANwAiACAAQgBhAGMAawBnAHIAbwB1AG4AZAA9ACIAIwA2AEYANgAzAEYARgAiAD4APABUAGUAeAB0AEIAbABvAGMAawAgAFQAZQB4AHQAPQAiAEEAIgAgAEYAbwBuAHQAUwBpAHoAZQA9ACIAMgA1ACIAIABGAG8AbgB0AFcAZQBpAGcAaAB0AD0AIgBCAG8AbABkACIAIABIAG8AcgBpAHoAbwBuAHQAYQBsAEEAbABpAGcAbgBtAGUAbgB0AD0AIgBDAGUAbgB0AGUAcgAiACAAVgBlAHIAdABpAGMAYQBsAEEAbABpAGcAbgBtAGUAbgB0AD0AIgBDAGUAbgB0AGUAcgAiACAARgBvAHIAZQBnAHIAbwB1AG4AZAA9ACIAVwBoAGkAdABlACIALwA+ADwALwBCAG8AcgBkAGUAcgA+ADwAUwB0AGEAYwBrAFAAYQBuAGUAbAAgAE0AYQByAGcAaQBuAD0AIgAxADUALAAyACwAMAAsADAAIgA+ADwAVABlAHgAdABCAGwAbwBjAGsAIABUAGUAeAB0AD0AIgBBAEwARwBPACAAUABBAE4ARQBMACIAIABGAG8AcgBlAGcAcgBvAHUAbgBkAD0AIgAjADkAQwA5ADQARgBGACIAIABGAG8AbgB0AFMAaQB6AGUAPQAiADEAMgAiACAARgBvAG4AdABXAGUAaQBnAGgAdAA9ACIAQgBvAGwAZAAiAC8APgA8AFQAZQB4AHQAQgBsAG8AYwBrACAAVABlAHgAdAA9ACIAxwBlAHYAcgBpAG0AZAAxAV8BMQEgAEEAawB0AGkAdgBhAHMAeQBvAG4AIgAgAEYAbwBuAHQAUwBpAHoAZQA9ACIAMgA1ACIAIABGAG8AbgB0AFcAZQBpAGcAaAB0AD0AIgBCAG8AbABkACIALwA+ADwALwBTAHQAYQBjAGsAUABhAG4AZQBsAD4APAAvAFMAdABhAGMAawBQAGEAbgBlAGwAPgAKACAAIAAgACAAPABUAGUAeAB0AEIAbABvAGMAawAgAEcAcgBpAGQALgBSAG8AdwA9ACIAMQAiACAAVABlAHgAdAA9ACIAQgB1ACAAYgBpAGwAZwBpAHMAYQB5AGEAcgAxAW4AIABjAGkAaABhAHoAIABrAG8AZAB1AG4AdQAgAHMAYQB0ADEBYwAxAXkAYQAgAGcA9gBuAGQAZQByAGkAbgAuACAAUwBhAHQAMQFjADEBbgAxAW4AIABvAGwAdQBfAXQAdQByAGQAdQAfAXUAIABhAG4AYQBoAHQAYQByADEBIABhAF8BYQAfATEBeQBhACAAeQBhAHAAMQFfAXQAMQFyADEBbgAuACAAMAFuAHQAZQByAG4AZQB0ACAAYgBhAB8BbABhAG4AdAAxAXMAMQEgAGcAZQByAGUAawBtAGUAegAuACIAIABGAG8AcgBlAGcAcgBvAHUAbgBkAD0AIgAjADkAQgBBADUAQgBBACIAIABGAG8AbgB0AFMAaQB6AGUAPQAiADEAMwAiACAAVABlAHgAdABXAHIAYQBwAHAAaQBuAGcAPQAiAFcAcgBhAHAAIgAgAEwAaQBuAGUASABlAGkAZwBoAHQAPQAiADIAMQAiACAATQBhAHIAZwBpAG4APQAiADAALAAwACwAMAAsADEAOAAiAC8APgAKACAAIAAgACAAPABCAG8AcgBkAGUAcgAgAEcAcgBpAGQALgBSAG8AdwA9ACIAMgAiACAAQgBhAGMAawBnAHIAbwB1AG4AZAA9ACIAIwAxADEAMQA3ADIANAAiACAAQgBvAHIAZABlAHIAQgByAHUAcwBoAD0AIgAjADIAQQAzADIANAA4ACIAIABCAG8AcgBkAGUAcgBUAGgAaQBjAGsAbgBlAHMAcwA9ACIAMQAiACAAQwBvAHIAbgBlAHIAUgBhAGQAaQB1AHMAPQAiADEAMgAiACAAUABhAGQAZABpAG4AZwA9ACIAMQA2ACIAIABNAGEAcgBnAGkAbgA9ACIAMAAsADAALAAwACwAMQA4ACIAPgA8AEcAcgBpAGQAPgA8AEcAcgBpAGQALgBDAG8AbAB1AG0AbgBEAGUAZgBpAG4AaQB0AGkAbwBuAHMAPgA8AEMAbwBsAHUAbQBuAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABXAGkAZAB0AGgAPQAiACoAIgAvAD4APABDAG8AbAB1AG0AbgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAVwBpAGQAdABoAD0AIgBBAHUAdABvACIALwA+ADwALwBHAHIAaQBkAC4AQwBvAGwAdQBtAG4ARABlAGYAaQBuAGkAdABpAG8AbgBzAD4APABTAHQAYQBjAGsAUABhAG4AZQBsAD4APABUAGUAeAB0AEIAbABvAGMAawAgAFQAZQB4AHQAPQAiAEMAMAFIAEEAWgAgAEsATwBEAFUAIgAgAEYAbwByAGUAZwByAG8AdQBuAGQAPQAiACMANwAwADcAQgA5ADIAIgAgAEYAbwBuAHQAUwBpAHoAZQA9ACIAMQAwACIAIABGAG8AbgB0AFcAZQBpAGcAaAB0AD0AIgBCAG8AbABkACIALwA+ADwAVABlAHgAdABCAGwAbwBjAGsAIABOAGEAbQBlAD0AIgBEAGUAdgBpAGMAZQBUAGUAeAB0ACIAIABGAG8AbgB0AEYAYQBtAGkAbAB5AD0AIgBDAG8AbgBzAG8AbABhAHMAIgAgAEYAbwBuAHQAUwBpAHoAZQA9ACIAMQA1ACIAIABGAG8AbgB0AFcAZQBpAGcAaAB0AD0AIgBCAG8AbABkACIAIABNAGEAcgBnAGkAbgA9ACIAMAAsADYALAA4ACwAMAAiACAAVABlAHgAdABXAHIAYQBwAHAAaQBuAGcAPQAiAFcAcgBhAHAAIgAvAD4APAAvAFMAdABhAGMAawBQAGEAbgBlAGwAPgA8AEIAdQB0AHQAbwBuACAATgBhAG0AZQA9ACIAQwBvAHAAeQBEAGUAdgBpAGMAZQAiACAARwByAGkAZAAuAEMAbwBsAHUAbQBuAD0AIgAxACIAIABDAG8AbgB0AGUAbgB0AD0AIgBLAG8AcAB5AGEAbABhACIAIABCAGEAYwBrAGcAcgBvAHUAbgBkAD0AIgAjADIANQAyAEQANAAwACIAIABGAG8AcgBlAGcAcgBvAHUAbgBkAD0AIgAjAEUANQBFADgARgAwACIALwA+ADwALwBHAHIAaQBkAD4APAAvAEIAbwByAGQAZQByAD4ACgAgACAAIAAgADwAUwB0AGEAYwBrAFAAYQBuAGUAbAAgAEcAcgBpAGQALgBSAG8AdwA9ACIAMwAiAD4APABUAGUAeAB0AEIAbABvAGMAawAgAFQAZQB4AHQAPQAiAEwAMAFTAEEATgBTACAAQQBOAEEASABUAEEAUgBJACIAIABGAG8AcgBlAGcAcgBvAHUAbgBkAD0AIgAjAEEAQQBCADIAQwAzACIAIABGAG8AbgB0AFMAaQB6AGUAPQAiADEAMQAiACAARgBvAG4AdABXAGUAaQBnAGgAdAA9ACIAQgBvAGwAZAAiACAATQBhAHIAZwBpAG4APQAiADAALAAwACwAMAAsADgAIgAvAD4APABUAGUAeAB0AEIAbwB4ACAATgBhAG0AZQA9ACIASwBlAHkAQgBvAHgAIgAgAEgAZQBpAGcAaAB0AD0AIgAxADEAMgAiACAAQQBjAGMAZQBwAHQAcwBSAGUAdAB1AHIAbgA9ACIAVAByAHUAZQAiACAAVABlAHgAdABXAHIAYQBwAHAAaQBuAGcAPQAiAFcAcgBhAHAAIgAgAFYAZQByAHQAaQBjAGEAbABTAGMAcgBvAGwAbABCAGEAcgBWAGkAcwBpAGIAaQBsAGkAdAB5AD0AIgBBAHUAdABvACIAIABGAG8AbgB0AEYAYQBtAGkAbAB5AD0AIgBDAG8AbgBzAG8AbABhAHMAIgAvAD4APAAvAFMAdABhAGMAawBQAGEAbgBlAGwAPgAKACAAIAAgACAAPABUAGUAeAB0AEIAbABvAGMAawAgAEcAcgBpAGQALgBSAG8AdwA9ACIANAAiACAATgBhAG0AZQA9ACIATQBlAHMAcwBhAGcAZQBUAGUAeAB0ACIAIABGAG8AcgBlAGcAcgBvAHUAbgBkAD0AIgAjAEYARgA4ADEAOQA1ACIAIABGAG8AbgB0AFMAaQB6AGUAPQAiADEAMgAiACAAVABlAHgAdABXAHIAYQBwAHAAaQBuAGcAPQAiAFcAcgBhAHAAIgAgAE0AYQByAGcAaQBuAD0AIgAwACwAMQAyACwAMAAsADAAIgAvAD4ACgAgACAAIAAgADwAQgBvAHIAZABlAHIAIABHAHIAaQBkAC4AUgBvAHcAPQAiADUAIgAgAFYAZQByAHQAaQBjAGEAbABBAGwAaQBnAG4AbQBlAG4AdAA9ACIAQgBvAHQAdABvAG0AIgAgAEIAYQBjAGsAZwByAG8AdQBuAGQAPQAiACMAMQAwADIANQAxAEYAIgAgAEIAbwByAGQAZQByAEIAcgB1AHMAaAA9ACIAIwAyADgANQAzADQANQAiACAAQgBvAHIAZABlAHIAVABoAGkAYwBrAG4AZQBzAHMAPQAiADEAIgAgAEMAbwByAG4AZQByAFIAYQBkAGkAdQBzAD0AIgAxADEAIgAgAFAAYQBkAGQAaQBuAGcAPQAiADEAMwAiACAATQBhAHIAZwBpAG4APQAiADAALAAyADAALAAwACwAMQA4ACIAPgA8AFQAZQB4AHQAQgBsAG8AYwBrACAAVABlAHgAdAA9ACIAQQBuAGEAaAB0AGEAcgAgAHkAYQBsAG4AMQF6AGMAYQAgAGIAdQAgAGIAaQBsAGcAaQBzAGEAeQBhAHIAZABhACAA5wBhAGwAMQFfATEBcgAuACAAUwD8AHIAZQAgAGIAaQB0AGUAbgBlACAAawBhAGQAYQByACAAdABlAGsAcgBhAHIAIABhAG4AYQBoAHQAYQByACAAcwBvAHIAdQBsAG0AYQB6AC4AIgAgAEYAbwByAGUAZwByAG8AdQBuAGQAPQAiACMANwA4AEQAOABCADQAIgAgAEYAbwBuAHQAUwBpAHoAZQA9ACIAMQAxACIAIABUAGUAeAB0AFcAcgBhAHAAcABpAG4AZwA9ACIAVwByAGEAcAAiAC8APgA8AC8AQgBvAHIAZABlAHIAPgAKACAAIAAgACAAPABHAHIAaQBkACAARwByAGkAZAAuAFIAbwB3AD0AIgA2ACIAPgA8AEcAcgBpAGQALgBDAG8AbAB1AG0AbgBEAGUAZgBpAG4AaQB0AGkAbwBuAHMAPgA8AEMAbwBsAHUAbQBuAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABXAGkAZAB0AGgAPQAiACoAIgAvAD4APABDAG8AbAB1AG0AbgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAVwBpAGQAdABoAD0AIgBBAHUAdABvACIALwA+ADwAQwBvAGwAdQBtAG4ARABlAGYAaQBuAGkAdABpAG8AbgAgAFcAaQBkAHQAaAA9ACIAQQB1AHQAbwAiAC8APgA8AC8ARwByAGkAZAAuAEMAbwBsAHUAbQBuAEQAZQBmAGkAbgBpAHQAaQBvAG4AcwA+ADwAQgB1AHQAdABvAG4AIABHAHIAaQBkAC4AQwBvAGwAdQBtAG4APQAiADEAIgAgAE4AYQBtAGUAPQAiAEMAYQBuAGMAZQBsAEIAdQB0AHQAbwBuACIAIABDAG8AbgB0AGUAbgB0AD0AIgBLAGEAcABhAHQAIgAgAEIAYQBjAGsAZwByAG8AdQBuAGQAPQAiACMAMgAwADIANgAzADgAIgAgAEYAbwByAGUAZwByAG8AdQBuAGQAPQAiACMARABEAEUAMQBFAEEAIgAgAE0AYQByAGcAaQBuAD0AIgAwACwAMAAsADkALAAwACIALwA+ADwAQgB1AHQAdABvAG4AIABHAHIAaQBkAC4AQwBvAGwAdQBtAG4APQAiADIAIgAgAE4AYQBtAGUAPQAiAEEAYwB0AGkAdgBhAHQAZQBCAHUAdAB0AG8AbgAiACAAQwBvAG4AdABlAG4AdAA9ACIARQB0AGsAaQBuAGwAZQBfAXQAaQByACIAIABCAGEAYwBrAGcAcgBvAHUAbgBkAD0AIgAjADYARgA2ADMARgBGACIAIABGAG8AcgBlAGcAcgBvAHUAbgBkAD0AIgBXAGgAaQB0AGUAIgAgAEkAcwBEAGUAZgBhAHUAbAB0AD0AIgBUAHIAdQBlACIALwA+ADwALwBHAHIAaQBkAD4ACgAgACAAPAAvAEcAcgBpAGQAPgAKADwALwBXAGkAbgBkAG8AdwA+AAoAJwBAAAoAJAByAGUAYQBkAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBYAG0AbAAuAFgAbQBsAE4AbwBkAGUAUgBlAGEAZABlAHIAIAAkAHgAYQBtAGwACgAkAHcAaQBuAGQAbwB3ACAAPQAgAFsAVwBpAG4AZABvAHcAcwAuAE0AYQByAGsAdQBwAC4AWABhAG0AbABSAGUAYQBkAGUAcgBdADoAOgBMAG8AYQBkACgAJAByAGUAYQBkAGUAcgApAAoAJAB3AGkAbgBkAG8AdwAuAEYAaQBuAGQATgBhAG0AZQAoACcARABlAHYAaQBjAGUAVABlAHgAdAAnACkALgBUAGUAeAB0ACAAPQAgACQAZABlAHYAaQBjAGUAQwBvAGQAZQAKACQAdwBpAG4AZABvAHcALgBGAGkAbgBkAE4AYQBtAGUAKAAnAE0AZQBzAHMAYQBnAGUAVABlAHgAdAAnACkALgBUAGUAeAB0ACAAPQAgACQAbQBlAHMAcwBhAGcAZQAKACQAawBlAHkAQgBvAHgAIAA9ACAAJAB3AGkAbgBkAG8AdwAuAEYAaQBuAGQATgBhAG0AZQAoACcASwBlAHkAQgBvAHgAJwApAAoAJABhAG4AcwB3AGUAcgAgAD0AIABAAHsAIABhAGMAdABpAG8AbgAgAD0AIAAnAGMAYQBuAGMAZQBsACcAOwAgAGsAZQB5ACAAPQAgACcAJwAgAH0ACgAkAHcAaQBuAGQAbwB3AC4ARgBpAG4AZABOAGEAbQBlACgAJwBDAG8AcAB5AEQAZQB2AGkAYwBlACcAKQAuAEEAZABkAF8AQwBsAGkAYwBrACgAewAgAFsAVwBpAG4AZABvAHcAcwAuAEMAbABpAHAAYgBvAGEAcgBkAF0AOgA6AFMAZQB0AFQAZQB4AHQAKAAkAGQAZQB2AGkAYwBlAEMAbwBkAGUAKQAgAH0AKQAKACQAdwBpAG4AZABvAHcALgBGAGkAbgBkAE4AYQBtAGUAKAAnAEMAYQBuAGMAZQBsAEIAdQB0AHQAbwBuACcAKQAuAEEAZABkAF8AQwBsAGkAYwBrACgAewAgACQAdwBpAG4AZABvAHcALgBEAGkAYQBsAG8AZwBSAGUAcwB1AGwAdAAgAD0AIAAkAGYAYQBsAHMAZQA7ACAAJAB3AGkAbgBkAG8AdwAuAEMAbABvAHMAZQAoACkAIAB9ACkACgAkAHcAaQBuAGQAbwB3AC4ARgBpAG4AZABOAGEAbQBlACgAJwBBAGMAdABpAHYAYQB0AGUAQgB1AHQAdABvAG4AJwApAC4AQQBkAGQAXwBDAGwAaQBjAGsAKAB7AAoAIAAgAGkAZgAgACgAWwBTAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAawBlAHkAQgBvAHgALgBUAGUAeAB0ACkAKQAgAHsAIAAkAHcAaQBuAGQAbwB3AC4ARgBpAG4AZABOAGEAbQBlACgAJwBNAGUAcwBzAGEAZwBlAFQAZQB4AHQAJwApAC4AVABlAHgAdAAgAD0AIAAnAEwAaQBzAGEAbgBzACAAYQBuAGEAaAB0AGEAcgAxAW4AMQEgAGcAaQByAGkAbgAuACcAOwAgAHIAZQB0AHUAcgBuACAAfQAKACAAIAAkAGEAbgBzAHcAZQByAC4AYQBjAHQAaQBvAG4AIAA9ACAAJwBhAGMAdABpAHYAYQB0AGUAJwA7ACAAJABhAG4AcwB3AGUAcgAuAGsAZQB5ACAAPQAgACQAawBlAHkAQgBvAHgALgBUAGUAeAB0AC4AVAByAGkAbQAoACkAOwAgACQAdwBpAG4AZABvAHcALgBEAGkAYQBsAG8AZwBSAGUAcwB1AGwAdAAgAD0AIAAkAHQAcgB1AGUAOwAgACQAdwBpAG4AZABvAHcALgBDAGwAbwBzAGUAKAApAAoAfQApAAoAJABrAGUAeQBCAG8AeAAuAEYAbwBjAHUAcwAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJAB3AGkAbgBkAG8AdwAuAFMAaABvAHcARABpAGEAbABvAGcAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAYQBuAHMAdwBlAHIAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMACgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2a857d14afa779c8e4f553fa4aeaef3ea7f42deee8dada1c82c696a8be645efa
MD5 ca3ffbd8fd7f68de98095aa8514490c4
SHA1 b6a8c155099c317bf0c1211a41ad3b7608f84527
SHA512 01fd2a385a6e7f9655b874766229156e2e632d61e09e0d25ca784c53d6ee1ba3c283938524d4c80dea0a7e83bd0415de0d52abe7142723e542516ce6b23a1fd4
TLSH
T1D531EF2BF3DC8296C899003620DD681032B983DB819FDF977681D145F83F388DEA4390
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_skld1nlf.qny.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_skld1nlf.qny.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1020-34-0x00000248D3300000-0x00000248D3308000-memory.dmp

Download

memory/1168-29-0x0000020621990000-0x0000020621EB8000-memory.dmp

Download

memory/1168-28-0x0000020621290000-0x0000020621452000-memory.dmp

Download

memory/1168-27-0x00000206210C0000-0x00000206210E4000-memory.dmp

Download

memory/1168-26-0x00000206210C0000-0x00000206210EA000-memory.dmp

Download

memory/1168-25-0x0000020620B60000-0x0000020620B6A000-memory.dmp

Download

memory/1168-24-0x0000020620EB0000-0x0000020620F62000-memory.dmp

Download

memory/1168-23-0x0000020620B20000-0x0000020620B3E000-memory.dmp

Download

memory/4780-8-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp

Download

memory/4780-14-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp

Download

memory/4780-16-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp

Download

memory/4780-13-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp

Download

memory/4780-11-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp

Download

memory/4780-10-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp

Download

memory/4780-9-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp

Download

memory/4780-1-0x00007FFC8914F000-0x00007FFC89150000-memory.dmp

Download

memory/4780-7-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp

Download

memory/4780-6-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp

Download

memory/4780-4-0x000001F400030000-0x000001F400052000-memory.dmp

Download

memory/4780-5-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp

Download