2ea195102f155ffc4fde3a1ac4a818ae286f0910994681473ba482cf05e74b47

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Size 41.3MB
Sample260905-2g6evatfma
SHA256 2ea195102f155ffc4fde3a1ac4a818ae286f0910994681473ba482cf05e74b47
MD5 9b47ecd98ae0e3734a38db77bd3acb3d
SHA1 3cc68fabde828f6cdfc1a9b47572dd2b5519ac17
SHA512 1ceb49dc513a83b8c6df174367bb577b3d53f6f08d0de4169a3c87bd43ea4cc141e4c1ba06436d0ec111f4ff099b40479f3e2f53aeb24598b5eba2015f509f6f
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYff:sMguj8Q4VfvHqFTrYaBPtR
TLSH
T136979C0772E601A5E5B3E1388AA74503D773B4674331DACF329D06552FABAE09A7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3804	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	reg.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Wine	reg.exe
Key opened	\REGISTRY\MACHINE\Software\Wine	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
8	discord.com
9	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2080	cmd.exe
3248	cmd.exe
2252	cmd.exe
2328	cmd.exe
4632	cmd.exe
5544	cmd.exe
4452	cmd.exe
4144	cmd.exe
1108	cmd.exe
4424	cmd.exe
5352	cmd.exe
244	cmd.exe
3152	cmd.exe
2236	cmd.exe
5016	cmd.exe
4628	cmd.exe
5656	cmd.exe
2900	cmd.exe
2492	cmd.exe
3276	cmd.exe
5556	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
3612	WMIC.exe
3612	WMIC.exe
3612	WMIC.exe
3612	WMIC.exe
5080	WMIC.exe
5080	WMIC.exe
5080	WMIC.exe
5080	WMIC.exe
4888	WMIC.exe
4888	WMIC.exe
4888	WMIC.exe
4888	WMIC.exe
5304	WMIC.exe
5304	WMIC.exe
5304	WMIC.exe
5304	WMIC.exe
5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeIncreaseQuotaPrivilege	3612	WMIC.exe
Token: SeSecurityPrivilege	3612	WMIC.exe
Token: SeTakeOwnershipPrivilege	3612	WMIC.exe
Token: SeLoadDriverPrivilege	3612	WMIC.exe
Token: SeSystemProfilePrivilege	3612	WMIC.exe
Token: SeSystemtimePrivilege	3612	WMIC.exe
Token: SeProfSingleProcessPrivilege	3612	WMIC.exe
Token: SeIncBasePriorityPrivilege	3612	WMIC.exe
Token: SeCreatePagefilePrivilege	3612	WMIC.exe
Token: SeBackupPrivilege	3612	WMIC.exe
Token: SeRestorePrivilege	3612	WMIC.exe
Token: SeShutdownPrivilege	3612	WMIC.exe
Token: SeDebugPrivilege	3612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3612	WMIC.exe
Token: SeRemoteShutdownPrivilege	3612	WMIC.exe
Token: SeUndockPrivilege	3612	WMIC.exe
Token: SeManageVolumePrivilege	3612	WMIC.exe
Token: 33	3612	WMIC.exe
Token: 34	3612	WMIC.exe
Token: 35	3612	WMIC.exe
Token: 36	3612	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3612	WMIC.exe
Token: SeSecurityPrivilege	3612	WMIC.exe
Token: SeTakeOwnershipPrivilege	3612	WMIC.exe
Token: SeLoadDriverPrivilege	3612	WMIC.exe
Token: SeSystemProfilePrivilege	3612	WMIC.exe
Token: SeSystemtimePrivilege	3612	WMIC.exe
Token: SeProfSingleProcessPrivilege	3612	WMIC.exe
Token: SeIncBasePriorityPrivilege	3612	WMIC.exe
Token: SeCreatePagefilePrivilege	3612	WMIC.exe
Token: SeBackupPrivilege	3612	WMIC.exe
Token: SeRestorePrivilege	3612	WMIC.exe
Token: SeShutdownPrivilege	3612	WMIC.exe
Token: SeDebugPrivilege	3612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3612	WMIC.exe
Token: SeRemoteShutdownPrivilege	3612	WMIC.exe
Token: SeUndockPrivilege	3612	WMIC.exe
Token: SeManageVolumePrivilege	3612	WMIC.exe
Token: 33	3612	WMIC.exe
Token: 34	3612	WMIC.exe
Token: 35	3612	WMIC.exe
Token: 36	3612	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5080	WMIC.exe
Token: SeSecurityPrivilege	5080	WMIC.exe
Token: SeTakeOwnershipPrivilege	5080	WMIC.exe
Token: SeLoadDriverPrivilege	5080	WMIC.exe
Token: SeSystemProfilePrivilege	5080	WMIC.exe
Token: SeSystemtimePrivilege	5080	WMIC.exe
Token: SeProfSingleProcessPrivilege	5080	WMIC.exe
Token: SeIncBasePriorityPrivilege	5080	WMIC.exe
Token: SeCreatePagefilePrivilege	5080	WMIC.exe
Token: SeBackupPrivilege	5080	WMIC.exe
Token: SeRestorePrivilege	5080	WMIC.exe
Token: SeShutdownPrivilege	5080	WMIC.exe
Token: SeDebugPrivilege	5080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5080	WMIC.exe
Token: SeRemoteShutdownPrivilege	5080	WMIC.exe
Token: SeUndockPrivilege	5080	WMIC.exe
Token: SeManageVolumePrivilege	5080	WMIC.exe
Token: 33	5080	WMIC.exe
Token: 34	5080	WMIC.exe
Token: 35	5080	WMIC.exe
Token: 36	5080	WMIC.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5328 wrote to memory of 2252	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	89
PID 2252 wrote to memory of 3804	2252	cmd.exe	91
PID 5328 wrote to memory of 2900	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	92
PID 2900 wrote to memory of 3052	2900	cmd.exe	94
PID 5328 wrote to memory of 3248	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	95
PID 3248 wrote to memory of 5420	3248	cmd.exe	97
PID 5328 wrote to memory of 1108	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	98
PID 1108 wrote to memory of 1328	1108	cmd.exe	100
PID 5328 wrote to memory of 2080	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	101
PID 2080 wrote to memory of 2356	2080	cmd.exe	103
PID 5328 wrote to memory of 4628	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	104
PID 4628 wrote to memory of 5944	4628	cmd.exe	106
PID 5328 wrote to memory of 5016	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	107
PID 5016 wrote to memory of 4220	5016	cmd.exe	109
PID 5328 wrote to memory of 5556	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	110
PID 5556 wrote to memory of 3492	5556	cmd.exe	112
PID 5328 wrote to memory of 3276	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	113
PID 3276 wrote to memory of 3604	3276	cmd.exe	115
PID 5328 wrote to memory of 4144	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	116
PID 4144 wrote to memory of 5836	4144	cmd.exe	118
PID 5328 wrote to memory of 4452	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	119
PID 4452 wrote to memory of 5140	4452	cmd.exe	121
PID 5328 wrote to memory of 5544	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	122
PID 5544 wrote to memory of 5528	5544	cmd.exe	124
PID 5328 wrote to memory of 2236	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	125
PID 2236 wrote to memory of 264	2236	cmd.exe	127
PID 5328 wrote to memory of 244	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	128
PID 244 wrote to memory of 2204	244	cmd.exe	130
PID 5328 wrote to memory of 2492	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	131
PID 2492 wrote to memory of 2924	2492	cmd.exe	133
PID 5328 wrote to memory of 4424	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	134
PID 4424 wrote to memory of 5464	4424	cmd.exe	136
PID 5328 wrote to memory of 5352	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	137
PID 5352 wrote to memory of 3612	5352	cmd.exe	139
PID 5328 wrote to memory of 3152	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	141
PID 3152 wrote to memory of 5080	3152	cmd.exe	143
PID 5328 wrote to memory of 2328	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	144
PID 2328 wrote to memory of 4888	2328	cmd.exe	146
PID 5328 wrote to memory of 4632	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	147
PID 4632 wrote to memory of 5304	4632	cmd.exe	149
PID 5328 wrote to memory of 5656	5328	2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe	150

C:\Users\Admin\AppData\Local\Temp\2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_9b47ecd98ae0e3734a38db77bd3acb3d_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "Get-Process | Select-Object -ExpandProperty Name""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Get-Process | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:3052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:1328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\FADT\VBOX__" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\FADT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:4220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"
    3⤵
    PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmtools" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\vmtools"
    3⤵
    - Looks for VMWare services registry key.
    PID:5140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
    3⤵
    PID:5528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\QEMU" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\QEMU"
    3⤵
    PID:264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Wine" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Wine"
    3⤵
    - Identifies Wine through registry keys
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\Software\Wine" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\Wine"
    3⤵
    - Identifies Wine through registry keys
    PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" /v DriverDesc 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\reg.exe
    REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" /v DriverDesc
    3⤵
    PID:5464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get description 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_videocontroller get description
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber,manufacturer 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber,manufacturer
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get manufacturer,model 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get manufacturer,model
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python "C:\Users\Admin\AppData\Local\Temp\af_scan_1788647686173.py""
  2⤵
  - Executes a command shell one-liner
  PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Yrwkjldu_1788647686338.zip

Path C:\Users\Admin\AppData\Local\Temp\trace_1788647686080\Yrwkjldu_1788647686338.zip
Size 22B
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
MD5 SHA1 SHA512

Submit Download

memory/3804-1-0x00007FFD8D4FF000-0x00007FFD8D500000-memory.dmp

Download

memory/3804-2-0x00007FFD8D370000-0x00007FFD8DD14000-memory.dmp

Download

memory/3804-3-0x00007FFD8D370000-0x00007FFD8DD14000-memory.dmp

Download

memory/3804-4-0x00007FFD8D370000-0x00007FFD8DD14000-memory.dmp

Download

memory/3804-5-0x0000011DFF660000-0x0000011DFF682000-memory.dmp

Download

memory/3804-8-0x00007FFD8D370000-0x00007FFD8DD14000-memory.dmp

Download

memory/3804-9-0x00007FFD8D370000-0x00007FFD8DD14000-memory.dmp

Download

memory/3804-11-0x00007FFD8D370000-0x00007FFD8DD14000-memory.dmp

Download

memory/3804-12-0x00007FFD8D370000-0x00007FFD8DD14000-memory.dmp

Download