1a05c300915c63d324a3ed8278db85158af10729e059da7c310e7f42c1eefd21

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
Size 24.5MB
Sample260901-27hfpsygrd
SHA256 1a05c300915c63d324a3ed8278db85158af10729e059da7c310e7f42c1eefd21
MD5 f7b8e768c92aad678c1efdfd057aea1e
SHA1 0ee4f429889be258519d4925f66250ecece66c0e
SHA512 0a776b6101b6aaa5984158a21b5f918bda5202321355eafb902f186b9d7ef42895396a0fd6912dc9f744765ef0328e89ece6a0021453219aef404fe817118913
SSDEEP 49152:vudCDvwT4vKKbhWj0wjlktD4a0CfZ1Cy988xJhGnSDJEKHMvtrI72dRt8rfIkata:tvKKbh6Jta+UUamsrfszizYP16
TLSH
T184476216B746898BE42A9634844B4FE4E325DCB186B0837733B9371D2FFE34C5EA6215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\48Ov1P = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	FyvvTe.exe

Executes dropped EXE 2 IoCs

pid	Process
4884	FyvvTe.exe
968	FyvvTe.exe

Loads dropped DLL 2 IoCs

pid	Process
4884	FyvvTe.exe
968	FyvvTe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\48Ov1P\\FyvvTe.exe\""	FyvvTe.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
8	cmd.exe
464	cmd.exe
3196	cmd.exe
1396	cmd.exe
1716	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	FyvvTe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1932	cmd.exe
2660	cmd.exe
2028	cmd.exe
4784	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4680	schtasks.exe
904	schtasks.exe
2096	schtasks.exe
4836	schtasks.exe
4728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
1028	2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe
4884	FyvvTe.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 8	4884	FyvvTe.exe	101
PID 8 wrote to memory of 2096	8	cmd.exe	104
PID 8 wrote to memory of 4792	8	cmd.exe	105
PID 8 wrote to memory of 3960	8	cmd.exe	107
PID 4884 wrote to memory of 464	4884	FyvvTe.exe	110
PID 464 wrote to memory of 4836	464	cmd.exe	113
PID 464 wrote to memory of 4192	464	cmd.exe	114
PID 464 wrote to memory of 4652	464	cmd.exe	116
PID 2028 wrote to memory of 3352	2028	cmd.exe	118
PID 4784 wrote to memory of 988	4784	cmd.exe	119
PID 4884 wrote to memory of 3196	4884	FyvvTe.exe	120
PID 4884 wrote to memory of 1396	4884	FyvvTe.exe	122
PID 3196 wrote to memory of 4728	3196	cmd.exe	124
PID 1396 wrote to memory of 4680	1396	cmd.exe	125
PID 3196 wrote to memory of 1772	3196	cmd.exe	126
PID 3196 wrote to memory of 992	3196	cmd.exe	128
PID 1396 wrote to memory of 2940	1396	cmd.exe	130
PID 1396 wrote to memory of 4600	1396	cmd.exe	131
PID 1932 wrote to memory of 4840	1932	cmd.exe	132
PID 4884 wrote to memory of 1716	4884	FyvvTe.exe	133
PID 1716 wrote to memory of 904	1716	cmd.exe	135
PID 1716 wrote to memory of 3984	1716	cmd.exe	136
PID 1716 wrote to memory of 2252	1716	cmd.exe	139
PID 2660 wrote to memory of 3784	2660	cmd.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_f7b8e768c92aad678c1efdfd057aea1e_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1028

C:\Users\Public\48Ov1P\FyvvTe.exe
C:\Users\Public\48Ov1P\FyvvTe.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\48Ov1P\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\48Ov1P\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4192
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4680
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2252

C:\Users\Public\48Ov1P\FyvvTe.exe
"C:\Users\Public\48Ov1P\FyvvTe.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\48Ov1P" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\48Ov1P" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3352

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2360

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:988

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4840

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FyvvTe.exe

Path C:\Users\Public\48Ov1P\FyvvTe.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\48Ov1P\UxEnhance64.dll
Size 3.1MB
SHA256 b5269c6ea891f35e4c4d3ff02acc5c2ea3dbf82e63dabcc8c835666f5698b259
MD5 500e5993c8f595af28d75fb10f8ae9c9
SHA1 d68abac2dbbb80ef301ee5114a0a67daae643ae6
SHA512 a39187a1bcda4437d80d512fe7f5065b49a56f18f960691c4fa818ad69a43ee9458cf25987a16452b53999202b1b44e15abe148edb4061b5a8a3120f72ca5a1a
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+9:P9m29xx3Tiqt06ox6+z2rNNrKo9
TLSH
T175E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\48Ov1P\adoresd.dat
Size 4.7MB
SHA256 a17c53045e9821acf43fbc889976fb9cfab2956465b34aca4d705010b1b64a4c
MD5 3389c24acd143fa9fff8c39506c46509
SHA1 9fe0289ed2dedcc36c8fd8fb3c5a81a84d516b33
SHA512 ec0b59aa88b7c0041822f697bca23ea218056a8ac9366ecf6a7b5242d6758c69e5df64e99d52b141c5310647fbd9cce0ffd85a783aa0f93a755fa40f8c39892f
SSDEEP 98304:IKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:IKClqhi0Cv54K2IVS0VQg
TLSH
T1AD3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\48Ov1P\msadox.tb
Size 8KB
SHA256 dd950c16856e5eaa0fddc7d1bf30b50bec7afd74187be1b82f2d83deed70504f
MD5 677c95c56fd28c6bf495c1379a4067b8
SHA1 0f967c6be703a2603feca29eb7687b7cb1c3b124
SHA512 7241d564489b14879d0d805adf423fc1d2b2dd7a3d66977c1edabb2b38c37336bb2fef448fc731501b31a2b2f4e8d670786b71712a7a434329f80065585102b8
SSDEEP 192:yqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ysZqZOXQ3uqvR2Kfzp
TLSH
T1AA029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/968-582-0x00000273F26E0000-0x00000273F2F67000-memory.dmp

Download

memory/968-581-0x00000273F26E0000-0x00000273F2F67000-memory.dmp

Download

memory/968-573-0x00000273F26E0000-0x00000273F2F67000-memory.dmp

Download

memory/968-576-0x00000273F26E0000-0x00000273F2F67000-memory.dmp

Download

memory/968-570-0x00007FFF8A630000-0x00007FFF8AB4E000-memory.dmp

Download

memory/968-575-0x00007FFFA7040000-0x00007FFFA7042000-memory.dmp

Download

memory/968-584-0x00007FFFA7030000-0x00007FFFA7032000-memory.dmp

Download

memory/968-583-0x00000273F26E0000-0x00000273F2F67000-memory.dmp

Download

memory/968-580-0x00000273F26E0000-0x00000273F2F67000-memory.dmp

Download

memory/1028-1-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/1028-524-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/1028-2-0x00000000001C0000-0x00000000001CC000-memory.dmp

Download

memory/1028-0-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/1028-504-0x00007FFF970A0000-0x00007FFF970B0000-memory.dmp

Download

memory/1028-525-0x00007FFF970A0000-0x00007FFF970B0000-memory.dmp

Download

memory/4884-531-0x00007FFF8A630000-0x00007FFF8AB4E000-memory.dmp

Download

memory/4884-559-0x00000216FAAC0000-0x00000216FAB4A000-memory.dmp

Download

memory/4884-558-0x00000216FAAC0000-0x00000216FAB4A000-memory.dmp

Download

memory/4884-557-0x00000216FAAC0000-0x00000216FAB4A000-memory.dmp

Download

memory/4884-563-0x00000216F9DC0000-0x00000216FA647000-memory.dmp

Download

memory/4884-565-0x00000216F9DC0000-0x00000216FA647000-memory.dmp

Download

memory/4884-556-0x00000216FAAC0000-0x00000216FAB4A000-memory.dmp

Download

memory/4884-555-0x00000216FA690000-0x00000216FA6DE000-memory.dmp

Download

memory/4884-550-0x00000216F9DC0000-0x00000216FA647000-memory.dmp

Download

memory/4884-545-0x00000216F9DC0000-0x00000216FA647000-memory.dmp

Download

memory/4884-546-0x00000216F9DC0000-0x00000216FA647000-memory.dmp

Download

memory/4884-544-0x00000216F9DC0000-0x00000216FA647000-memory.dmp

Download

memory/4884-543-0x00000216F9DC0000-0x00000216FA647000-memory.dmp

Download

memory/4884-538-0x00007FFFA7040000-0x00007FFFA7042000-memory.dmp

Download

memory/4884-539-0x00000216F9DC0000-0x00000216FA647000-memory.dmp

Download

memory/4884-536-0x00000216F9DC0000-0x00000216FA647000-memory.dmp

Download

memory/4884-530-0x00007FFFA7030000-0x00007FFFA7032000-memory.dmp

Download