fde588edbc62bd2ed0b3561d321af36cf10eab7980f02eb8e43aea58c0356786

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
Size 24.5MB
Sample260901-2f7lhsfa88
SHA256 fde588edbc62bd2ed0b3561d321af36cf10eab7980f02eb8e43aea58c0356786
MD5 00811e386d3f50a135a58e4cd3e34145
SHA1 4befd012a9ecea78129fa080c8720957d02d0895
SHA512 51d7b400a27ca839cdf4f732ed4eb4111bb05ce2b5c7d6f03d8e7c7aad94bebf3d3d7a2919745ddea799e954e2a822d16d22f5c319b5e5c90a93d65b5108e274
SSDEEP 49152:DudCDvwT4vKKbhWj0wjlktD4a0CfZ1Cy988xJhGnSDJEKHMvtrI72dRt8rfIkatk:5vKKbh6Jta+UUamsrfszizYP1E
TLSH
T162476216B746898BE42A9634844B4FE4E325DCB186B0837733B9371D2FFE34C5EA6215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\vgIMaa = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables containing artifacts associated with disabling Widnows Defender 2 IoCs

resource	yara_rule
behavioral1/memory/1788-677-0x0000000002FD0000-0x00000000037D3000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/1788-681-0x0000000002FD0000-0x00000000037D3000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	s9rLrx.exe

Executes dropped EXE 2 IoCs

pid	Process
5428	s9rLrx.exe
5524	s9rLrx.exe

Loads dropped DLL 2 IoCs

pid	Process
5428	s9rLrx.exe
5524	s9rLrx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\vgIMaa\\s9rLrx.exe\""	s9rLrx.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5380	cmd.exe
6060	cmd.exe
4908	cmd.exe
1496	cmd.exe
5460	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	s9rLrx.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\v8uO63	s9rLrx.exe
File created	C:\Program Files (x86)\v8uO63\v8uO63.exe	s9rLrx.exe
File created	C:\Program Files (x86)\v8uO63\image.png	s9rLrx.exe
File opened for modification	C:\Program Files (x86)\v8uO63\v8uO63.exe	s9rLrx.exe
File opened for modification	C:\Program Files (x86)\v8uO63\XPSPLOG.dll	s9rLrx.exe
File opened for modification	C:\Program Files (x86)\v8uO63\thumbs.db	s9rLrx.exe
File created	C:\Program Files (x86)\v8uO63\XPSPLOG.dll	s9rLrx.exe
File created	C:\Program Files (x86)\v8uO63\thumbs.db	s9rLrx.exe
File opened for modification	C:\Program Files (x86)\v8uO63\image.png	s9rLrx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4940	cmd.exe
3404	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	s9rLrx.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5656	schtasks.exe
5024	schtasks.exe
860	schtasks.exe
1948	schtasks.exe
1192	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4588	2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe
5428	s9rLrx.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 1496	5428	s9rLrx.exe	102
PID 1496 wrote to memory of 5656	1496	cmd.exe	106
PID 1496 wrote to memory of 5652	1496	cmd.exe	107
PID 5428 wrote to memory of 5460	5428	s9rLrx.exe	109
PID 1496 wrote to memory of 5020	1496	cmd.exe	115
PID 5460 wrote to memory of 5024	5460	cmd.exe	116
PID 5428 wrote to memory of 5380	5428	s9rLrx.exe	118
PID 5460 wrote to memory of 2812	5460	cmd.exe	120
PID 5460 wrote to memory of 5604	5460	cmd.exe	122
PID 5380 wrote to memory of 860	5380	cmd.exe	123
PID 5428 wrote to memory of 6060	5428	s9rLrx.exe	121
PID 6060 wrote to memory of 1948	6060	cmd.exe	125
PID 5428 wrote to memory of 4908	5428	s9rLrx.exe	126
PID 5380 wrote to memory of 2044	5380	cmd.exe	128
PID 4908 wrote to memory of 1192	4908	cmd.exe	130
PID 6060 wrote to memory of 5992	6060	cmd.exe	131
PID 5380 wrote to memory of 6032	5380	cmd.exe	133
PID 4908 wrote to memory of 5824	4908	cmd.exe	134
PID 6060 wrote to memory of 3832	6060	cmd.exe	135
PID 4908 wrote to memory of 4880	4908	cmd.exe	136
PID 4940 wrote to memory of 5516	4940	cmd.exe	138
PID 3404 wrote to memory of 1812	3404	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588

C:\Users\Public\vgIMaa\s9rLrx.exe
C:\Users\Public\vgIMaa\s9rLrx.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vgIMaa\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vgIMaa\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5656
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5024
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2812
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2044
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5992
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1192
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5824
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4880
- C:\Program Files (x86)\v8uO63\v8uO63.exe
  "C:\Program Files (x86)\v8uO63\v8uO63.exe"
  2⤵
  PID:1788

C:\Users\Public\vgIMaa\s9rLrx.exe
"C:\Users\Public\vgIMaa\s9rLrx.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5524

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vgIMaa" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vgIMaa" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5516

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5872

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1812

C:\Program Files (x86)\v8uO63\v8uO63.exe
"C:\Program Files (x86)\v8uO63\v8uO63.exe"
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\v8uO63\XPSPLOG.dll
Size 4.6MB
SHA256 2353bdb069eb06263657f98de01b0108ffa6272ee504aa4c81c760934fec759a
MD5 04a1b24da2c35b6f7ac2dfda08820d80
SHA1 b72307a0f84490bbd89b89b2a669b082151673e4
SHA512 fe71872d6f5d99578f8cfb218639fb6527dbd6a7f55f228ab5f23c372e3ff5d95885a294efd5cae5a24c455065ef56c0d583bb91d8fe74d9a6906b809b9182fc
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyM:BMWKfU+BcUTHCCCfqCiUffnM
TLSH
T12C263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\v8uO63\XPSPLOG.dll
Size 1.6MB
SHA256 a922aebf2d177a0402e40957f52e8993822597efc59ceb79683674ad6c27d137
MD5 dede738ed04f74de5d126b0094ec6ab0
SHA1 6d24442f92e515bac9367df73162827499f7ccaf
SHA512 8ad45590b2e40c6f991f000554ddd2da31a1a211843cb09fb0f89b242683f2ee3d1b1163a52829a5db9515c83f7a86177a1515d47ba805856bf5d42ee7802d3b
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXT5tpB1JA6nvsNBFGGLncY:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcY
TLSH
T1357533D7B1DB451EF6A073B52E8CED2CB17E99C881BDC526A8D6318B0031AAE503D74D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\v8uO63\image.png
Size 5.0MB
SHA256 7ad9c2df396ee317c0081d6148c9d01cc46ff673b4e1a96d5841996e32732049
MD5 b98c3ac26b3db98da05f0a05a3c497de
SHA1 99bf16896a6f6a787b9af61feea67976e6f2343e
SHA512 6f7678f50c9dfdf8dc57439269377dc5e30d584c52f272acbbd06a74c660d066a71e467b966f29032d4735988cb4d6d7e2d0e5e3f72636307681378b0e92f095
SSDEEP 98304:1FYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:SRIUjDgAk+jkn/IXhVaK
TLSH
T1103633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\v8uO63\thumbs.db
Size 358KB
SHA256 6fc653a2c9bf544518e9417e96eb21d474e6275a6e437d403df8c08ad312382a
MD5 74b3de20a77c4a13a4724f8664c59bf9
SHA1 9854f93fc97abacf38598501873a0e8c9125ac75
SHA512 80d94f2cc126429011a573446fe655ef457cc7ece338de3b2e7d1ce0f67d5f4ac156b280396e6f9027761db6a9915c3a1601da60ac1398ff7a5f6bb25f9bda19
SSDEEP 6144:7iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:+8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T14674F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8uO63.exe

Path C:\Program Files (x86)\v8uO63\v8uO63.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 126dc5f2b8c64f28a46b2c119954d81c084c36d90c8787368774479f62c23b14
MD5 b4821fd0dfe267eafe9dd3e4d9a2c8df
SHA1 f085cf8ce2413b2bc5c0c3346ead1551864edad0
SHA512 d9a039f96bb4270567aedd41e312af5fc6db0ec347fd5f34ad52600555da4f707331a6330ed78eb65d94fc018470840e714002c80e6eabcd48486684bec9d5dc
TLSH
T1A6C04C9453B84364F075693F2D825AE19FBB5E15A526C3A42F74414C9468A100832E66
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\vgIMaa\UxEnhance64.dll
Size 3.1MB
SHA256 fcc82fc0c8994bb630c7beef36097d4f3f6cee679ab6bc5f394e1ee1ad236602
MD5 172c41f277f4dfdac41b016df92cceb2
SHA1 efbf73d71b00ce52fef39ba2287cd7b2e6cbf172
SHA512 f1490ac3e48cfd81ae4bb51425927b76fbce27a2aa3f86c648f478794e36fca171b3eb7994be7bb3106d816fca76ebd2b1f47cbc2fe206e4d0650e0775080776
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+a:P9m29xx3Tiqt06ox6+z2rNNrKoa
TLSH
T1CBE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\vgIMaa\adoresd.dat
Size 4.7MB
SHA256 7e486177e0e3590b416dcc49e2af78d9be7a73c1f5baa8150e8e99723c524ece
MD5 41f084b55bc6c01c183518df3ffcc0bf
SHA1 a37564ee07147b8c55cb90cb384970ec93818424
SHA512 8cab225888ffdad886de0c080009416b791976eb4937dfb1c382ccc9931bbc804e68a60eb44aeab682da7ad7f494e8a3e982a4a33e4fa4d5c7d717aa20578b1b
SSDEEP 98304:GKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:GKClqhi0Cv54K2IVS0VQg
TLSH
T1B23633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\vgIMaa\msadox.tb
Size 8KB
SHA256 2683b259dd4d7a932bd2f82750c00f6d0f1df623672168d0b8a2f8db0ce78b4c
MD5 6d8845c6d35d36c24ce6ce02178f845f
SHA1 14de44053e576cf39edca94cd9f687c99d0000e8
SHA512 dc9f2e8a878c394fef209aecee00b7554879f7e33c89b221ca3ce06a9d62fac69f6256d8a9cd8e10b994f3110694882b863c81492f93c8d9d4d48bbdc0ad44ea
SSDEEP 192:xqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:xsZqZOXQ3uqvR2Kfzp
TLSH
T175029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s9rLrx.exe

Path C:\Users\Public\vgIMaa\s9rLrx.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1788-669-0x00000000008C0000-0x00000000008C1000-memory.dmp

Download

memory/1788-681-0x0000000002FD0000-0x00000000037D3000-memory.dmp

Download

memory/1788-688-0x0000000000CD0000-0x0000000000CE4000-memory.dmp

Download

memory/1788-677-0x0000000002FD0000-0x00000000037D3000-memory.dmp

Download

memory/1788-676-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/1788-674-0x0000000002FD0000-0x00000000037D3000-memory.dmp

Download

memory/1788-670-0x0000000074B40000-0x000000007528A000-memory.dmp

Download

memory/4588-0-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4588-529-0x00007FFC3C870000-0x00007FFC3C880000-memory.dmp

Download

memory/4588-528-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4588-504-0x00007FFC3C870000-0x00007FFC3C880000-memory.dmp

Download

memory/4588-2-0x00000000004D0000-0x00000000004DC000-memory.dmp

Download

memory/4588-1-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/5428-540-0x000001E196A90000-0x000001E197317000-memory.dmp

Download

memory/5428-543-0x000001E196A90000-0x000001E197317000-memory.dmp

Download

memory/5428-562-0x000001E197770000-0x000001E1977FA000-memory.dmp

Download

memory/5428-535-0x00007FFC23E80000-0x00007FFC2439E000-memory.dmp

Download

memory/5428-534-0x00007FFC41FF0000-0x00007FFC41FF2000-memory.dmp

Download

memory/5428-542-0x00007FFC42000000-0x00007FFC42002000-memory.dmp

Download

memory/5428-548-0x000001E196A90000-0x000001E197317000-memory.dmp

Download

memory/5428-547-0x000001E196A90000-0x000001E197317000-memory.dmp

Download

memory/5428-549-0x000001E196A90000-0x000001E197317000-memory.dmp

Download

memory/5428-559-0x000001E1948B0000-0x000001E1948FE000-memory.dmp

Download

memory/5428-550-0x000001E196A90000-0x000001E197317000-memory.dmp

Download

memory/5428-554-0x000001E196A90000-0x000001E197317000-memory.dmp

Download

memory/5428-560-0x000001E197770000-0x000001E1977FA000-memory.dmp

Download

memory/5428-568-0x000001E196A90000-0x000001E197317000-memory.dmp

Download

memory/5428-567-0x000001E196A90000-0x000001E197317000-memory.dmp

Download

memory/5428-563-0x000001E197770000-0x000001E1977FA000-memory.dmp

Download

memory/5428-561-0x000001E197770000-0x000001E1977FA000-memory.dmp

Download

memory/5524-580-0x000002829C360000-0x000002829CBE7000-memory.dmp

Download

memory/5524-586-0x000002829C360000-0x000002829CBE7000-memory.dmp

Download

memory/5524-587-0x000002829C360000-0x000002829CBE7000-memory.dmp

Download

memory/5524-588-0x00007FFC41FF0000-0x00007FFC41FF2000-memory.dmp

Download

memory/5524-585-0x000002829C360000-0x000002829CBE7000-memory.dmp

Download

memory/5524-584-0x000002829C360000-0x000002829CBE7000-memory.dmp

Download

memory/5524-579-0x00007FFC42000000-0x00007FFC42002000-memory.dmp

Download

memory/5524-577-0x000002829C360000-0x000002829CBE7000-memory.dmp

Download

memory/5524-574-0x00007FFC23E80000-0x00007FFC2439E000-memory.dmp

Download