a91bbe051aa7064d3aec9d218eea6b90094b16e7a4ca37be5a419befc69dab25

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Size 40.7MB
Sample260816-e1vfcscr7s
SHA256 a91bbe051aa7064d3aec9d218eea6b90094b16e7a4ca37be5a419befc69dab25
MD5 66b0a98dc3b60a04dfb291253abdab90
SHA1 867b8a6884fe3d7b6bdbd50d5b727e2973bbf733
SHA512 1ecaf3f1ba58655c5099469426685917dab0a8ec0d9cb376b3755f0b0bb6fa87363205229f0ee7f14b877b8c92c3929dd6733744072f8aedcdcb1e849c935663
SSDEEP 49152:HJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejntU:Hu/9nmHZLxG80DuKA3XAD8ntZfh6fgC/
TLSH
T190974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jaQf1T.exe

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\0rydXD = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Detects executables containing artifacts associated with disabling Widnows Defender 2 IoCs

resource	yara_rule
behavioral1/memory/344-674-0x0000000003C10000-0x0000000004417000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/344-678-0x0000000003C10000-0x0000000004417000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	M1TX2a.exe

Executes dropped EXE 3 IoCs

pid	Process
2596	M1TX2a.exe
1464	M1TX2a.exe
344	jaQf1T.exe

Loads dropped DLL 3 IoCs

pid	Process
2596	M1TX2a.exe
1464	M1TX2a.exe
344	jaQf1T.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\0rydXD\\M1TX2a.exe\""	M1TX2a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\jaQf1T\\jaQf1T.exe\""	jaQf1T.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4532	cmd.exe
5080	cmd.exe
4232	cmd.exe
4064	cmd.exe
3560	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	M1TX2a.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\jaQf1T\image.png	M1TX2a.exe
File opened for modification	C:\Program Files (x86)\jaQf1T\XPSPLOG.dll	M1TX2a.exe
File opened for modification	C:\Program Files (x86)\jaQf1T\image.png	M1TX2a.exe
File opened for modification	C:\Program Files (x86)\jaQf1T\thumbs.db	M1TX2a.exe
File opened for modification	C:\Program Files (x86)\jaQf1T	M1TX2a.exe
File created	C:\Program Files (x86)\jaQf1T\jaQf1T.exe	M1TX2a.exe
File created	C:\Program Files (x86)\jaQf1T\XPSPLOG.dll	M1TX2a.exe
File created	C:\Program Files (x86)\jaQf1T\thumbs.db	M1TX2a.exe
File opened for modification	C:\Program Files (x86)\jaQf1T\jaQf1T.exe	M1TX2a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4012	cmd.exe
2072	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaQf1T.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	M1TX2a.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5068	schtasks.exe
812	schtasks.exe
4160	schtasks.exe
3276	schtasks.exe
1272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
1548	2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe
2596	M1TX2a.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 4532	2596	M1TX2a.exe	96
PID 4532 wrote to memory of 5068	4532	cmd.exe	99
PID 2596 wrote to memory of 5080	2596	M1TX2a.exe	101
PID 4532 wrote to memory of 2816	4532	cmd.exe	103
PID 5080 wrote to memory of 812	5080	cmd.exe	105
PID 4532 wrote to memory of 456	4532	cmd.exe	108
PID 2596 wrote to memory of 4232	2596	M1TX2a.exe	109
PID 5080 wrote to memory of 436	5080	cmd.exe	111
PID 4232 wrote to memory of 4160	4232	cmd.exe	112
PID 5080 wrote to memory of 1936	5080	cmd.exe	113
PID 4012 wrote to memory of 64	4012	cmd.exe	114
PID 4232 wrote to memory of 3468	4232	cmd.exe	115
PID 4232 wrote to memory of 4740	4232	cmd.exe	116
PID 2596 wrote to memory of 4064	2596	M1TX2a.exe	117
PID 2596 wrote to memory of 3560	2596	M1TX2a.exe	119
PID 4064 wrote to memory of 3276	4064	cmd.exe	121
PID 3560 wrote to memory of 1272	3560	cmd.exe	122
PID 4064 wrote to memory of 3608	4064	cmd.exe	123
PID 3560 wrote to memory of 4708	3560	cmd.exe	124
PID 4064 wrote to memory of 2284	4064	cmd.exe	126
PID 3560 wrote to memory of 4576	3560	cmd.exe	127
PID 2072 wrote to memory of 1240	2072	cmd.exe	129
PID 2596 wrote to memory of 344	2596	M1TX2a.exe	130

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jaQf1T.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_66b0a98dc3b60a04dfb291253abdab90_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1548

C:\Users\Public\0rydXD\M1TX2a.exe
C:\Users\Public\0rydXD\M1TX2a.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\0rydXD\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\0rydXD\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:812
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:436
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3276
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3608
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1272
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4708
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4576
- C:\Program Files (x86)\jaQf1T\jaQf1T.exe
  "C:\Program Files (x86)\jaQf1T\jaQf1T.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:344

C:\Users\Public\0rydXD\M1TX2a.exe
"C:\Users\Public\0rydXD\M1TX2a.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\0rydXD" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\0rydXD" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:64

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2872

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\jaQf1T\XPSPLOG.dll
Size 4.6MB
SHA256 e987998d8a1b5d24b76de8dcf0c6150cf9067058d51ed076f0512d9742b4218c
MD5 f09f29838ee510629377d1be4b9cd153
SHA1 108199226b584cb6a4787eb101edc20effde8f2a
SHA512 fd00fdf396b9e090c0361a68d4d21fe0c46ec0a20aafba8d33597b391738772321ac0cade3ebad97cfbc57cb59227df29be9eb3884fb71bd8c79ebfdb41d6526
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyL:BMWKfU+BcUTHCCCfqCiUffnL
TLSH
T15A263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\jaQf1T\image.png
Size 5.0MB
SHA256 709c2f23b615cf2f015e41e6ecb6291db3dc7b5ed3fd4713fae28c20adec6337
MD5 4e10b0c357b7c04cb0330e967fbd4f8f
SHA1 56d241e61e9fe4bc08b22da6e0a40321ad22f3a1
SHA512 8cde4a384791813716cf1ae773b762b1f8b4a8ce4bf7a7c53c557cc4fbab11f99ba78e5b8104b1949f9dde1a833a1a25af6cf8ab31b01cb05b5499aabfa4993f
SSDEEP 98304:yqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:O/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T13F363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaQf1T.exe

Path C:\Program Files (x86)\jaQf1T\jaQf1T.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\jaQf1T\thumbs.db
Size 358KB
SHA256 b9faf15a8d31f9dcdba5f45c04f840318288012ed3526d3d84b293108146f531
MD5 e74d0d9fad4b20b60a9147fc766d6fec
SHA1 45ca3247ba3a68dc97a3ab31ba828516a2b59bea
SHA512 58a850a04488b66a9aa7e79540fc18e3d82581ddbc7ec008006652ec901131ea49d30cb2cb136b8bb67359b1803af548f04e6999b50c05ebff279d4e40ec4346
SSDEEP 6144:yiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:N8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T11074F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M1TX2a.exe

Path C:\Users\Public\0rydXD\M1TX2a.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\0rydXD\UxEnhance64.dll
Size 3.1MB
SHA256 e1abd4e5e805403caeee4e304e5fb8491900c1d417a55be0328e2f07165e797a
MD5 03d5dacca54d4c6b3002f430a1938fee
SHA1 a05b313ba5b6f233c2a5216ccd7942f9088e4ab0
SHA512 15bc974de7ce75dafca9f9f35c145dc43766fd0aa86fc1ce2d74b0a7704226a4c284821fccc3a1312ec0583456d167892cfa7dc2fed808dc25ae151eb9d42ec1
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+c:P9m29xx3Tiqt06ox6+z2rNNrKoc
TLSH
T168E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\0rydXD\adoresd.dat
Size 4.7MB
SHA256 642da59a3ebe6e6af3e69fdc897d53d63a9543e24401c3720ee36e0552724292
MD5 efb6dcac1f831a0cc61020c1d74e75e1
SHA1 d510dc1d02844ebf39ecafa4d72e1f407be955a7
SHA512 bfe0d561b1ad3f36ab75d1cbcbd4cab25c9f8a07d98d000d0dbbec7cfb676fdcbe405dbfff4c63a1a1c0f0984df27ba13857904e58489969d6d3358abe175672
SSDEEP 98304:qmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:5u1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1A53633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\0rydXD\msadox.tb
Size 8KB
SHA256 92f6278a214047db00129451f7e8ddc771597c37efc393b6ae9f6f3e183d31e6
MD5 5c5456d5456a11af49fb071c0abb6073
SHA1 80ab103fcfd0e3770c98f747d719a121d6e25587
SHA512 59cf4807b4f3e53e299123a3ab892f20a198d50625606c36ce39a853e9a33565de7a66fbb7fe71f4f4a970c6db65281684a464dedfc2e96aa24fffbb48b31d29
SSDEEP 192:vqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:vsZqZOXQ3uqvR2Kfzp
TLSH
T10D029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/344-674-0x0000000003C10000-0x0000000004417000-memory.dmp

Download

memory/344-667-0x0000000075090000-0x00000000757DA000-memory.dmp

Download

memory/344-671-0x0000000003C10000-0x0000000004417000-memory.dmp

Download

memory/344-673-0x00000000019D0000-0x00000000019D1000-memory.dmp

Download

memory/344-666-0x00000000019B0000-0x00000000019B1000-memory.dmp

Download

memory/344-678-0x0000000003C10000-0x0000000004417000-memory.dmp

Download

memory/1464-592-0x000001B25F970000-0x000001B260201000-memory.dmp

Download

memory/1464-593-0x000001B25F970000-0x000001B260201000-memory.dmp

Download

memory/1464-584-0x000001B25F970000-0x000001B260201000-memory.dmp

Download

memory/1464-582-0x00007FFC567C0000-0x00007FFC56CDE000-memory.dmp

Download

memory/1464-595-0x00007FFC73F70000-0x00007FFC73F72000-memory.dmp

Download

memory/1464-594-0x000001B25F970000-0x000001B260201000-memory.dmp

Download

memory/1464-591-0x000001B25F970000-0x000001B260201000-memory.dmp

Download

memory/1464-586-0x00007FFC73F80000-0x00007FFC73F82000-memory.dmp

Download

memory/1464-587-0x000001B25F970000-0x000001B260201000-memory.dmp

Download

memory/1548-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/1548-525-0x00007FFC6AF00000-0x00007FFC6AF10000-memory.dmp

Download

memory/1548-524-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/1548-504-0x00007FFC6AF00000-0x00007FFC6AF10000-memory.dmp

Download

memory/1548-2-0x00000000001F0000-0x00000000001FC000-memory.dmp

Download

memory/1548-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/2596-564-0x0000019C22370000-0x0000019C22C01000-memory.dmp

Download

memory/2596-536-0x0000019C22370000-0x0000019C22C01000-memory.dmp

Download

memory/2596-566-0x0000019C22370000-0x0000019C22C01000-memory.dmp

Download

memory/2596-556-0x0000019C23030000-0x0000019C230BA000-memory.dmp

Download

memory/2596-557-0x0000019C23030000-0x0000019C230BA000-memory.dmp

Download

memory/2596-543-0x0000019C22370000-0x0000019C22C01000-memory.dmp

Download

memory/2596-558-0x0000019C23030000-0x0000019C230BA000-memory.dmp

Download

memory/2596-538-0x00007FFC73F80000-0x00007FFC73F82000-memory.dmp

Download

memory/2596-539-0x0000019C22370000-0x0000019C22C01000-memory.dmp

Download

memory/2596-555-0x0000019C20140000-0x0000019C2018E000-memory.dmp

Download

memory/2596-531-0x00007FFC567C0000-0x00007FFC56CDE000-memory.dmp

Download

memory/2596-530-0x00007FFC73F70000-0x00007FFC73F72000-memory.dmp

Download

memory/2596-559-0x0000019C23030000-0x0000019C230BA000-memory.dmp

Download

memory/2596-550-0x0000019C22370000-0x0000019C22C01000-memory.dmp

Download

memory/2596-546-0x0000019C22370000-0x0000019C22C01000-memory.dmp

Download

memory/2596-545-0x0000019C22370000-0x0000019C22C01000-memory.dmp

Download

memory/2596-544-0x0000019C22370000-0x0000019C22C01000-memory.dmp

Download