273c570f6b28d4449221d8a6cb4c32635c82ef67178e4899e53451c930b84659

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe
Size 274KB
Sample260821-dqm3vs1hnd
SHA256 273c570f6b28d4449221d8a6cb4c32635c82ef67178e4899e53451c930b84659
MD5 2a99c36eaf67870c2753d13057d95697
SHA1 a1cf19edc9ecdb0738dfd3d9412b29d653c25b17
SHA512 ec022523b385b83e156f187ccd28cb59db4046e9a039bbc1ace3339bc79f4ff2eeb91b78e162f26c1016666f7463c71534dfc12cbc8a7b51f8a641c2ffeb0308
SSDEEP 3072:BYyMd3CV6qXQag8hRzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzKrKMF9qIE:BYkIqTg2X
TLSH
T1EB54094C1689C2A9C677C7F9E389E5C1A36EEBB3078485EBB26F4F821723C0CD946545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Detects ransomware indicator 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b860-0.dat	SUSP_RANSOMWARE_Indicator_Jul20

Renames multiple (108) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 64 IoCs

pid	Process
4108	ixghwr.exe
3348	nvwmwh.exe
5816	009bk0.exe
1376	1ry0rd.exe
4592	zsld51.exe
1948	zfbvmw.exe
6104	rygovs.exe
2416	vc3fb5.exe
4740	priin9.exe
1696	5dv60j.exe
5712	omp7zr.exe
2872	tgu3sn.exe
2376	lfupvm.exe
3004	wovmzw.exe
3472	urg23u.exe
364	i4c1kb.exe
5904	2i4c48.exe
5332	wz22de.exe
4636	n4tntq.exe
820	kt4pbb.exe
1956	jdqx1p.exe
3432	hpv7vq.exe
2768	5gqgr0.exe
476	lgkv6e.exe
5960	j7sh9j.exe
5664	lg42q2.exe
4472	27zv2q.exe
5416	qwaob4.exe
2360	htw87n.exe
3292	ytxidt.exe
3696	tp3i5z.exe
5928	16nf7j.exe
572	aq7o33.exe
2684	3uuabu.exe
5888	wt4bli.exe
5440	oxoen8.exe
2844	qz5zfy.exe
5532	wdm8ms.exe
1316	c6w9j2.exe
4240	gsio80.exe
2616	aimaqb.exe
4736	prngkg.exe
480	liw8sl.exe
3144	6vgyqr.exe
1964	e8swua.exe
1876	nt7ru7.exe
4496	s0o3go.exe
4624	5lrh3y.exe
2072	znauab.exe
1864	5atqna.exe
4272	ly7sat.exe
5964	3s286e.exe
816	959n7b.exe
540	zvbs07.exe
1944	lb6l6d.exe
1516	acztky.exe
4832	oj3m8f.exe
4480	ahfgi2.exe
2812	wwr5of.exe
5132	uz9wxn.exe
2056	dwql74.exe
612	il0jh5.exe
4956	hp5ux3.exe
1200	kuejs1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5960	j7sh9j.exe
6020	wpmxua.exe
6104	rygovs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe
1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe
4108	ixghwr.exe
4108	ixghwr.exe
3348	nvwmwh.exe
3348	nvwmwh.exe
5816	009bk0.exe
5816	009bk0.exe
1376	1ry0rd.exe
1376	1ry0rd.exe
4592	zsld51.exe
4592	zsld51.exe
1948	zfbvmw.exe
1948	zfbvmw.exe
6104	rygovs.exe
6104	rygovs.exe
2416	vc3fb5.exe
2416	vc3fb5.exe
4740	priin9.exe
4740	priin9.exe
1696	5dv60j.exe
1696	5dv60j.exe
5712	omp7zr.exe
5712	omp7zr.exe
2872	tgu3sn.exe
2872	tgu3sn.exe
2376	lfupvm.exe
2376	lfupvm.exe
3004	wovmzw.exe
3004	wovmzw.exe
3472	urg23u.exe
3472	urg23u.exe
364	i4c1kb.exe
364	i4c1kb.exe
5904	2i4c48.exe
5904	2i4c48.exe
5332	wz22de.exe
5332	wz22de.exe
4636	n4tntq.exe
4636	n4tntq.exe
820	kt4pbb.exe
820	kt4pbb.exe
1956	jdqx1p.exe
1956	jdqx1p.exe
3432	hpv7vq.exe
3432	hpv7vq.exe
2768	5gqgr0.exe
2768	5gqgr0.exe
476	lgkv6e.exe
476	lgkv6e.exe
5960	j7sh9j.exe
5960	j7sh9j.exe
5664	lg42q2.exe
5664	lg42q2.exe
4472	27zv2q.exe
4472	27zv2q.exe
5416	qwaob4.exe
5416	qwaob4.exe
2360	htw87n.exe
2360	htw87n.exe
3292	ytxidt.exe
3292	ytxidt.exe
3696	tp3i5z.exe
3696	tp3i5z.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 4108	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	90
PID 1720 wrote to memory of 3348	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	91
PID 1720 wrote to memory of 5816	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	92
PID 1720 wrote to memory of 1376	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	93
PID 1720 wrote to memory of 4592	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	95
PID 1720 wrote to memory of 1948	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	96
PID 1720 wrote to memory of 6104	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	97
PID 1720 wrote to memory of 2416	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	98
PID 1720 wrote to memory of 4740	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	99
PID 1720 wrote to memory of 1696	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	100
PID 1720 wrote to memory of 5712	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	101
PID 1720 wrote to memory of 2872	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	102
PID 1720 wrote to memory of 2376	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	103
PID 1720 wrote to memory of 3004	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	104
PID 1720 wrote to memory of 3472	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	105
PID 1720 wrote to memory of 364	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	106
PID 1720 wrote to memory of 5904	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	107
PID 1720 wrote to memory of 5332	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	108
PID 1720 wrote to memory of 4636	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	109
PID 1720 wrote to memory of 820	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	110
PID 1720 wrote to memory of 1956	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	111
PID 1720 wrote to memory of 3432	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	112
PID 1720 wrote to memory of 2768	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	113
PID 1720 wrote to memory of 476	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	114
PID 1720 wrote to memory of 5960	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	115
PID 1720 wrote to memory of 5664	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	116
PID 1720 wrote to memory of 4472	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	117
PID 1720 wrote to memory of 5416	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	118
PID 1720 wrote to memory of 2360	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	119
PID 1720 wrote to memory of 3292	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	120
PID 1720 wrote to memory of 3696	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	121
PID 1720 wrote to memory of 5928	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	122
PID 1720 wrote to memory of 572	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	123
PID 1720 wrote to memory of 2684	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	124
PID 1720 wrote to memory of 5888	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	125
PID 1720 wrote to memory of 5440	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	126
PID 1720 wrote to memory of 2844	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	127
PID 1720 wrote to memory of 5532	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	128
PID 1720 wrote to memory of 1316	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	129
PID 1720 wrote to memory of 4240	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	130
PID 1720 wrote to memory of 2616	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	131
PID 1720 wrote to memory of 4736	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	132
PID 1720 wrote to memory of 480	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	133
PID 1720 wrote to memory of 3144	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	134
PID 1720 wrote to memory of 1964	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	135
PID 1720 wrote to memory of 1876	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	136
PID 1720 wrote to memory of 4496	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	137
PID 1720 wrote to memory of 4624	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	138
PID 1720 wrote to memory of 2072	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	139
PID 1720 wrote to memory of 1864	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	140
PID 1720 wrote to memory of 4272	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	141
PID 1720 wrote to memory of 5964	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	142
PID 1720 wrote to memory of 816	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	143
PID 1720 wrote to memory of 540	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	144
PID 1720 wrote to memory of 1944	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	145
PID 1720 wrote to memory of 1516	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	146
PID 1720 wrote to memory of 4832	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	147
PID 1720 wrote to memory of 4480	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	148
PID 1720 wrote to memory of 2812	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	149
PID 1720 wrote to memory of 5132	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	150
PID 1720 wrote to memory of 2056	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	151
PID 1720 wrote to memory of 612	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	152
PID 1720 wrote to memory of 4956	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	153
PID 1720 wrote to memory of 1200	1720	2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe	154

C:\Users\Admin\AppData\Local\Temp\2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_2a99c36eaf67870c2753d13057d95697_cobalt-strike_icedid.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\ixghwr.exe
  "C:\Users\Admin\AppData\Local\Temp\ixghwr.exe" "C:\Users\Admin\Desktop\AddImport.scf" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\nvwmwh.exe
  "C:\Users\Admin\AppData\Local\Temp\nvwmwh.exe" "C:\Users\Admin\Desktop\AddUnpublish.jpg" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\009bk0.exe
  "C:\Users\Admin\AppData\Local\Temp\009bk0.exe" "C:\Users\Admin\Desktop\CloseHide.docx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5816
- C:\Users\Admin\AppData\Local\Temp\1ry0rd.exe
  "C:\Users\Admin\AppData\Local\Temp\1ry0rd.exe" "C:\Users\Admin\Desktop\CompleteOptimize.docm" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- C:\Users\Admin\AppData\Local\Temp\zsld51.exe
  "C:\Users\Admin\AppData\Local\Temp\zsld51.exe" "C:\Users\Admin\Desktop\CompressClear.ocx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Users\Admin\AppData\Local\Temp\zfbvmw.exe
  "C:\Users\Admin\AppData\Local\Temp\zfbvmw.exe" "C:\Users\Admin\Desktop\ConvertFromUnpublish.docx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\rygovs.exe
  "C:\Users\Admin\AppData\Local\Temp\rygovs.exe" "C:\Users\Admin\Desktop\EditPing.xml" -child
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6104
- C:\Users\Admin\AppData\Local\Temp\vc3fb5.exe
  "C:\Users\Admin\AppData\Local\Temp\vc3fb5.exe" "C:\Users\Admin\Desktop\FindNew.xlsx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\priin9.exe
  "C:\Users\Admin\AppData\Local\Temp\priin9.exe" "C:\Users\Admin\Desktop\GrantMount.dll" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Users\Admin\AppData\Local\Temp\5dv60j.exe
  "C:\Users\Admin\AppData\Local\Temp\5dv60j.exe" "C:\Users\Admin\Desktop\LimitJoin.fon" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Users\Admin\AppData\Local\Temp\omp7zr.exe
  "C:\Users\Admin\AppData\Local\Temp\omp7zr.exe" "C:\Users\Admin\Desktop\NewRevoke.wdp" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5712
- C:\Users\Admin\AppData\Local\Temp\tgu3sn.exe
  "C:\Users\Admin\AppData\Local\Temp\tgu3sn.exe" "C:\Users\Admin\Desktop\OptimizeClear.vsdm" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\lfupvm.exe
  "C:\Users\Admin\AppData\Local\Temp\lfupvm.exe" "C:\Users\Admin\Desktop\PopDisconnect.inf" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Users\Admin\AppData\Local\Temp\wovmzw.exe
  "C:\Users\Admin\AppData\Local\Temp\wovmzw.exe" "C:\Users\Admin\Desktop\PopSkip.xlsx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3004
- C:\Users\Admin\AppData\Local\Temp\urg23u.exe
  "C:\Users\Admin\AppData\Local\Temp\urg23u.exe" "C:\Users\Admin\Desktop\ReceiveWrite.mp4" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\i4c1kb.exe
  "C:\Users\Admin\AppData\Local\Temp\i4c1kb.exe" "C:\Users\Admin\Desktop\RestartMove.xlsx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- C:\Users\Admin\AppData\Local\Temp\2i4c48.exe
  "C:\Users\Admin\AppData\Local\Temp\2i4c48.exe" "C:\Users\Admin\Desktop\SplitCompress.DVR-MS" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5904
- C:\Users\Admin\AppData\Local\Temp\wz22de.exe
  "C:\Users\Admin\AppData\Local\Temp\wz22de.exe" "C:\Users\Admin\Desktop\SplitResize.rtf" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5332
- C:\Users\Admin\AppData\Local\Temp\n4tntq.exe
  "C:\Users\Admin\AppData\Local\Temp\n4tntq.exe" "C:\Users\Admin\Desktop\SplitTest.aif" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Users\Admin\AppData\Local\Temp\kt4pbb.exe
  "C:\Users\Admin\AppData\Local\Temp\kt4pbb.exe" "C:\Users\Admin\Desktop\StepInstall.wmf" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:820
- C:\Users\Admin\AppData\Local\Temp\jdqx1p.exe
  "C:\Users\Admin\AppData\Local\Temp\jdqx1p.exe" "C:\Users\Admin\Desktop\UnblockEnable.wmf" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\hpv7vq.exe
  "C:\Users\Admin\AppData\Local\Temp\hpv7vq.exe" "C:\Users\Admin\Desktop\UnblockExpand.xps" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Users\Admin\AppData\Local\Temp\5gqgr0.exe
  "C:\Users\Admin\AppData\Local\Temp\5gqgr0.exe" "C:\Users\Admin\Desktop\UnblockRemove.MOD" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Users\Admin\AppData\Local\Temp\lgkv6e.exe
  "C:\Users\Admin\AppData\Local\Temp\lgkv6e.exe" "C:\Users\Admin\Desktop\UnpublishAdd.eps" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:476
- C:\Users\Admin\AppData\Local\Temp\j7sh9j.exe
  "C:\Users\Admin\AppData\Local\Temp\j7sh9j.exe" "C:\Users\Admin\Desktop\UnregisterPing.kix" -child
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Users\Admin\AppData\Local\Temp\lg42q2.exe
  "C:\Users\Admin\AppData\Local\Temp\lg42q2.exe" "C:\Users\Admin\Desktop\UseEnable.wvx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5664
- C:\Users\Admin\AppData\Local\Temp\27zv2q.exe
  "C:\Users\Admin\AppData\Local\Temp\27zv2q.exe" "C:\Users\Admin\Desktop\UsePush.docx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Users\Admin\AppData\Local\Temp\qwaob4.exe
  "C:\Users\Admin\AppData\Local\Temp\qwaob4.exe" "C:\Users\Admin\Desktop\WaitConfirm.dib" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5416
- C:\Users\Admin\AppData\Local\Temp\htw87n.exe
  "C:\Users\Admin\AppData\Local\Temp\htw87n.exe" "C:\Users\Admin\Documents\ApproveConfirm.xlt" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Users\Admin\AppData\Local\Temp\ytxidt.exe
  "C:\Users\Admin\AppData\Local\Temp\ytxidt.exe" "C:\Users\Admin\Documents\ComparePop.xla" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Users\Admin\AppData\Local\Temp\tp3i5z.exe
  "C:\Users\Admin\AppData\Local\Temp\tp3i5z.exe" "C:\Users\Admin\Documents\CompletePublish.xlsb" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Users\Admin\AppData\Local\Temp\16nf7j.exe
  "C:\Users\Admin\AppData\Local\Temp\16nf7j.exe" "C:\Users\Admin\Documents\DebugImport.potm" -child
  2⤵
  - Executes dropped EXE
  PID:5928
- C:\Users\Admin\AppData\Local\Temp\aq7o33.exe
  "C:\Users\Admin\AppData\Local\Temp\aq7o33.exe" "C:\Users\Admin\Documents\DebugUnregister.vssx" -child
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Users\Admin\AppData\Local\Temp\3uuabu.exe
  "C:\Users\Admin\AppData\Local\Temp\3uuabu.exe" "C:\Users\Admin\Documents\ExitRegister.xlsm" -child
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\wt4bli.exe
  "C:\Users\Admin\AppData\Local\Temp\wt4bli.exe" "C:\Users\Admin\Documents\GrantRead.xlsx" -child
  2⤵
  - Executes dropped EXE
  PID:5888
- C:\Users\Admin\AppData\Local\Temp\oxoen8.exe
  "C:\Users\Admin\AppData\Local\Temp\oxoen8.exe" "C:\Users\Admin\Documents\GroupReset.xlsx" -child
  2⤵
  - Executes dropped EXE
  PID:5440
- C:\Users\Admin\AppData\Local\Temp\qz5zfy.exe
  "C:\Users\Admin\AppData\Local\Temp\qz5zfy.exe" "C:\Users\Admin\Documents\HideDebug.vssx" -child
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Users\Admin\AppData\Local\Temp\wdm8ms.exe
  "C:\Users\Admin\AppData\Local\Temp\wdm8ms.exe" "C:\Users\Admin\Documents\InstallDisconnect.docx" -child
  2⤵
  - Executes dropped EXE
  PID:5532
- C:\Users\Admin\AppData\Local\Temp\c6w9j2.exe
  "C:\Users\Admin\AppData\Local\Temp\c6w9j2.exe" "C:\Users\Admin\Documents\LockSet.xls" -child
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Users\Admin\AppData\Local\Temp\gsio80.exe
  "C:\Users\Admin\AppData\Local\Temp\gsio80.exe" "C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2" -child
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Users\Admin\AppData\Local\Temp\aimaqb.exe
  "C:\Users\Admin\AppData\Local\Temp\aimaqb.exe" "C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one" -child
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Users\Admin\AppData\Local\Temp\prngkg.exe
  "C:\Users\Admin\AppData\Local\Temp\prngkg.exe" "C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.one" -child
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\liw8sl.exe
  "C:\Users\Admin\AppData\Local\Temp\liw8sl.exe" "C:\Users\Admin\Documents\OptimizeUnregister.ods" -child
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Users\Admin\AppData\Local\Temp\6vgyqr.exe
  "C:\Users\Admin\AppData\Local\Temp\6vgyqr.exe" "C:\Users\Admin\Documents\OutClear.ppsx" -child
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Users\Admin\AppData\Local\Temp\e8swua.exe
  "C:\Users\Admin\AppData\Local\Temp\e8swua.exe" "C:\Users\Admin\Documents\Outlook Files\Outlook Data File - hfsueyirnw.pst" -child
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Users\Admin\AppData\Local\Temp\nt7ru7.exe
  "C:\Users\Admin\AppData\Local\Temp\nt7ru7.exe" "C:\Users\Admin\Documents\ReceiveRedo.xml" -child
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Users\Admin\AppData\Local\Temp\s0o3go.exe
  "C:\Users\Admin\AppData\Local\Temp\s0o3go.exe" "C:\Users\Admin\Documents\RegisterGrant.docx" -child
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\5lrh3y.exe
  "C:\Users\Admin\AppData\Local\Temp\5lrh3y.exe" "C:\Users\Admin\Documents\RestartNew.docx" -child
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Users\Admin\AppData\Local\Temp\znauab.exe
  "C:\Users\Admin\AppData\Local\Temp\znauab.exe" "C:\Users\Admin\Documents\RestoreEnable.vssx" -child
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Users\Admin\AppData\Local\Temp\5atqna.exe
  "C:\Users\Admin\AppData\Local\Temp\5atqna.exe" "C:\Users\Admin\Documents\RevokeSplit.xlt" -child
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Users\Admin\AppData\Local\Temp\ly7sat.exe
  "C:\Users\Admin\AppData\Local\Temp\ly7sat.exe" "C:\Users\Admin\Documents\SaveDebug.rtf" -child
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Users\Admin\AppData\Local\Temp\3s286e.exe
  "C:\Users\Admin\AppData\Local\Temp\3s286e.exe" "C:\Users\Admin\Documents\SelectBlock.vdx" -child
  2⤵
  - Executes dropped EXE
  PID:5964
- C:\Users\Admin\AppData\Local\Temp\959n7b.exe
  "C:\Users\Admin\AppData\Local\Temp\959n7b.exe" "C:\Users\Admin\Documents\SelectSubmit.xls" -child
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Users\Admin\AppData\Local\Temp\zvbs07.exe
  "C:\Users\Admin\AppData\Local\Temp\zvbs07.exe" "C:\Users\Admin\Documents\SetUse.xlsm" -child
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Users\Admin\AppData\Local\Temp\lb6l6d.exe
  "C:\Users\Admin\AppData\Local\Temp\lb6l6d.exe" "C:\Users\Admin\Documents\StartJoin.odp" -child
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Users\Admin\AppData\Local\Temp\acztky.exe
  "C:\Users\Admin\AppData\Local\Temp\acztky.exe" "C:\Users\Admin\Documents\StopFind.ppsm" -child
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\oj3m8f.exe
  "C:\Users\Admin\AppData\Local\Temp\oj3m8f.exe" "C:\Users\Admin\Documents\SuspendExit.dotm" -child
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Users\Admin\AppData\Local\Temp\ahfgi2.exe
  "C:\Users\Admin\AppData\Local\Temp\ahfgi2.exe" "C:\Users\Admin\Documents\UninstallUse.xlsm" -child
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Users\Admin\AppData\Local\Temp\wwr5of.exe
  "C:\Users\Admin\AppData\Local\Temp\wwr5of.exe" "C:\Users\Admin\Pictures\BlockGet.dib" -child
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\uz9wxn.exe
  "C:\Users\Admin\AppData\Local\Temp\uz9wxn.exe" "C:\Users\Admin\Pictures\CompareReset.ico" -child
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Users\Admin\AppData\Local\Temp\dwql74.exe
  "C:\Users\Admin\AppData\Local\Temp\dwql74.exe" "C:\Users\Admin\Pictures\CompleteRestart.dwg" -child
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Users\Admin\AppData\Local\Temp\il0jh5.exe
  "C:\Users\Admin\AppData\Local\Temp\il0jh5.exe" "C:\Users\Admin\Pictures\ConvertGet.svgz" -child
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Users\Admin\AppData\Local\Temp\hp5ux3.exe
  "C:\Users\Admin\AppData\Local\Temp\hp5ux3.exe" "C:\Users\Admin\Pictures\DebugPublish.cr2" -child
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Users\Admin\AppData\Local\Temp\kuejs1.exe
  "C:\Users\Admin\AppData\Local\Temp\kuejs1.exe" "C:\Users\Admin\Pictures\GetDebug.raw" -child
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Users\Admin\AppData\Local\Temp\3h6q4k.exe
  "C:\Users\Admin\AppData\Local\Temp\3h6q4k.exe" "C:\Users\Admin\Pictures\GrantShow.dwg" -child
  2⤵
  PID:544
- C:\Users\Admin\AppData\Local\Temp\roexpe.exe
  "C:\Users\Admin\AppData\Local\Temp\roexpe.exe" "C:\Users\Admin\Pictures\PushUnprotect.ico" -child
  2⤵
  PID:4224
- C:\Users\Admin\AppData\Local\Temp\8f0n87.exe
  "C:\Users\Admin\AppData\Local\Temp\8f0n87.exe" "C:\Users\Admin\Pictures\RemoveHide.jpg" -child
  2⤵
  PID:3240
- C:\Users\Admin\AppData\Local\Temp\ljpsqt.exe
  "C:\Users\Admin\AppData\Local\Temp\ljpsqt.exe" "C:\Users\Admin\Pictures\ResolveSuspend.eps" -child
  2⤵
  PID:4368
- C:\Users\Admin\AppData\Local\Temp\dv581h.exe
  "C:\Users\Admin\AppData\Local\Temp\dv581h.exe" "C:\Users\Admin\Pictures\RevokeRestore.pcx" -child
  2⤵
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\9wazse.exe
  "C:\Users\Admin\AppData\Local\Temp\9wazse.exe" "C:\Users\Admin\Pictures\wbmhjtnZ.jpg" -child
  2⤵
  PID:5292
- C:\Users\Admin\AppData\Local\Temp\bm58rm.exe
  "C:\Users\Admin\AppData\Local\Temp\bm58rm.exe" "C:\Users\Admin\Downloads\AddJoin.html" -child
  2⤵
  PID:3076
- C:\Users\Admin\AppData\Local\Temp\yoo5we.exe
  "C:\Users\Admin\AppData\Local\Temp\yoo5we.exe" "C:\Users\Admin\Downloads\AddRead.wmx" -child
  2⤵
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\rqn08n.exe
  "C:\Users\Admin\AppData\Local\Temp\rqn08n.exe" "C:\Users\Admin\Downloads\AssertResolve.M2V" -child
  2⤵
  PID:6032
- C:\Users\Admin\AppData\Local\Temp\s7p0em.exe
  "C:\Users\Admin\AppData\Local\Temp\s7p0em.exe" "C:\Users\Admin\Downloads\CheckpointDismount.3gp" -child
  2⤵
  PID:1584
- C:\Users\Admin\AppData\Local\Temp\wjxcla.exe
  "C:\Users\Admin\AppData\Local\Temp\wjxcla.exe" "C:\Users\Admin\Downloads\CloseRemove.xml" -child
  2⤵
  PID:5256
- C:\Users\Admin\AppData\Local\Temp\48903g.exe
  "C:\Users\Admin\AppData\Local\Temp\48903g.exe" "C:\Users\Admin\Downloads\CompareInitialize.htm" -child
  2⤵
  PID:5240
- C:\Users\Admin\AppData\Local\Temp\e6kq4f.exe
  "C:\Users\Admin\AppData\Local\Temp\e6kq4f.exe" "C:\Users\Admin\Downloads\CompareProtect.cr2" -child
  2⤵
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\4bqd5n.exe
  "C:\Users\Admin\AppData\Local\Temp\4bqd5n.exe" "C:\Users\Admin\Downloads\CompareSubmit.bin" -child
  2⤵
  PID:5824
- C:\Users\Admin\AppData\Local\Temp\uwek98.exe
  "C:\Users\Admin\AppData\Local\Temp\uwek98.exe" "C:\Users\Admin\Downloads\DebugMeasure.inf" -child
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\xfez2z.exe
  "C:\Users\Admin\AppData\Local\Temp\xfez2z.exe" "C:\Users\Admin\Downloads\DisableUnpublish.odt" -child
  2⤵
  PID:1824
- C:\Users\Admin\AppData\Local\Temp\l7394a.exe
  "C:\Users\Admin\AppData\Local\Temp\l7394a.exe" "C:\Users\Admin\Downloads\EnterAdd.otf" -child
  2⤵
  PID:5600
- C:\Users\Admin\AppData\Local\Temp\qdq9d8.exe
  "C:\Users\Admin\AppData\Local\Temp\qdq9d8.exe" "C:\Users\Admin\Downloads\ExpandPush.dib" -child
  2⤵
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\ay35zh.exe
  "C:\Users\Admin\AppData\Local\Temp\ay35zh.exe" "C:\Users\Admin\Downloads\GroupMerge.mp4v" -child
  2⤵
  PID:3500
- C:\Users\Admin\AppData\Local\Temp\9k1g3r.exe
  "C:\Users\Admin\AppData\Local\Temp\9k1g3r.exe" "C:\Users\Admin\Downloads\ImportClose.svgz" -child
  2⤵
  PID:1076
- C:\Users\Admin\AppData\Local\Temp\2cyr61.exe
  "C:\Users\Admin\AppData\Local\Temp\2cyr61.exe" "C:\Users\Admin\Downloads\InstallConfirm.ods" -child
  2⤵
  PID:792
- C:\Users\Admin\AppData\Local\Temp\mpk8jt.exe
  "C:\Users\Admin\AppData\Local\Temp\mpk8jt.exe" "C:\Users\Admin\Downloads\InstallDisconnect.xht" -child
  2⤵
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\7675su.exe
  "C:\Users\Admin\AppData\Local\Temp\7675su.exe" "C:\Users\Admin\Downloads\LockUpdate.txt" -child
  2⤵
  PID:1380
- C:\Users\Admin\AppData\Local\Temp\137vmi.exe
  "C:\Users\Admin\AppData\Local\Temp\137vmi.exe" "C:\Users\Admin\Downloads\MergeRepair.ico" -child
  2⤵
  PID:3948
- C:\Users\Admin\AppData\Local\Temp\fxza39.exe
  "C:\Users\Admin\AppData\Local\Temp\fxza39.exe" "C:\Users\Admin\Downloads\MountSplit.emf" -child
  2⤵
  PID:2960
- C:\Users\Admin\AppData\Local\Temp\wpmxua.exe
  "C:\Users\Admin\AppData\Local\Temp\wpmxua.exe" "C:\Users\Admin\Downloads\PingAssert.exe" -child
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6020
- C:\Users\Admin\AppData\Local\Temp\mhns3w.exe
  "C:\Users\Admin\AppData\Local\Temp\mhns3w.exe" "C:\Users\Admin\Downloads\PopUnlock.bmp" -child
  2⤵
  PID:4352
- C:\Users\Admin\AppData\Local\Temp\9tc0bm.exe
  "C:\Users\Admin\AppData\Local\Temp\9tc0bm.exe" "C:\Users\Admin\Downloads\ReceiveRedo.ppsm" -child
  2⤵
  PID:4568
- C:\Users\Admin\AppData\Local\Temp\wt69vl.exe
  "C:\Users\Admin\AppData\Local\Temp\wt69vl.exe" "C:\Users\Admin\Downloads\RegisterResolve.inf" -child
  2⤵
  PID:5736
- C:\Users\Admin\AppData\Local\Temp\2yy2g7.exe
  "C:\Users\Admin\AppData\Local\Temp\2yy2g7.exe" "C:\Users\Admin\Downloads\RenameInitialize.pps" -child
  2⤵
  PID:3336
- C:\Users\Admin\AppData\Local\Temp\9nwuqc.exe
  "C:\Users\Admin\AppData\Local\Temp\9nwuqc.exe" "C:\Users\Admin\Downloads\RepairEnable.txt" -child
  2⤵
  PID:5720
- C:\Users\Admin\AppData\Local\Temp\gaarq6.exe
  "C:\Users\Admin\AppData\Local\Temp\gaarq6.exe" "C:\Users\Admin\Downloads\RestoreBackup.mht" -child
  2⤵
  PID:4256
- C:\Users\Admin\AppData\Local\Temp\hmdtkm.exe
  "C:\Users\Admin\AppData\Local\Temp\hmdtkm.exe" "C:\Users\Admin\Downloads\RevokeBlock.ttf" -child
  2⤵
  PID:5688
- C:\Users\Admin\AppData\Local\Temp\3wzrx0.exe
  "C:\Users\Admin\AppData\Local\Temp\3wzrx0.exe" "C:\Users\Admin\Downloads\SaveInitialize.wax" -child
  2⤵
  PID:260
- C:\Users\Admin\AppData\Local\Temp\ageivv.exe
  "C:\Users\Admin\AppData\Local\Temp\ageivv.exe" "C:\Users\Admin\Downloads\SearchImport.mpv2" -child
  2⤵
  PID:364
- C:\Users\Admin\AppData\Local\Temp\be9ndb.exe
  "C:\Users\Admin\AppData\Local\Temp\be9ndb.exe" "C:\Users\Admin\Downloads\SubmitMove.avi" -child
  2⤵
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\7rfcv6.exe
  "C:\Users\Admin\AppData\Local\Temp\7rfcv6.exe" "C:\Users\Admin\Downloads\SuspendTest.bmp" -child
  2⤵
  PID:4748
- C:\Users\Admin\AppData\Local\Temp\ve8owy.exe
  "C:\Users\Admin\AppData\Local\Temp\ve8owy.exe" "C:\Users\Admin\Downloads\SwitchBackup.mpeg" -child
  2⤵
  PID:4552
- C:\Users\Admin\AppData\Local\Temp\lq85yw.exe
  "C:\Users\Admin\AppData\Local\Temp\lq85yw.exe" "C:\Users\Admin\Downloads\SwitchHide.easmx" -child
  2⤵
  PID:5036
- C:\Users\Admin\AppData\Local\Temp\xqipeu.exe
  "C:\Users\Admin\AppData\Local\Temp\xqipeu.exe" "C:\Users\Admin\Downloads\TestShow.pps" -child
  2⤵
  PID:3752
- C:\Users\Admin\AppData\Local\Temp\yma5d5.exe
  "C:\Users\Admin\AppData\Local\Temp\yma5d5.exe" "C:\Users\Admin\Downloads\UnblockExport.nfo" -child
  2⤵
  PID:4164
- C:\Users\Admin\AppData\Local\Temp\g5463a.exe
  "C:\Users\Admin\AppData\Local\Temp\g5463a.exe" "C:\Users\Admin\Downloads\UninstallConfirm.mhtml" -child
  2⤵
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\b2c116.exe
  "C:\Users\Admin\AppData\Local\Temp\b2c116.exe" "C:\Users\Admin\Downloads\UnpublishTest.png" -child
  2⤵
  PID:3288
- C:\Users\Admin\AppData\Local\Temp\qjrqad.exe
  "C:\Users\Admin\AppData\Local\Temp\qjrqad.exe" "C:\Users\Admin\Downloads\UnregisterReceive.mp2" -child
  2⤵
  PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ixghwr.exe

Path C:\Users\Admin\AppData\Local\Temp\ixghwr.exe
Size 274KB
SHA256 273c570f6b28d4449221d8a6cb4c32635c82ef67178e4899e53451c930b84659
MD5 2a99c36eaf67870c2753d13057d95697
SHA1 a1cf19edc9ecdb0738dfd3d9412b29d653c25b17
SHA512 ec022523b385b83e156f187ccd28cb59db4046e9a039bbc1ace3339bc79f4ff2eeb91b78e162f26c1016666f7463c71534dfc12cbc8a7b51f8a641c2ffeb0308
SSDEEP 3072:BYyMd3CV6qXQag8hRzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzKrKMF9qIE:BYkIqTg2X
TLSH
T1EB54094C1689C2A9C677C7F9E389E5C1A36EEBB3078485EBB26F4F821723C0CD946545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download