Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/09/2026, 23:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
- Size 5.0MB
- Sample260906-24aaxsstat
- SHA256 837b99aabda10e749b4ded71377f848f995ce2c55bdf6fa77fa58f7b971b03a2
- MD5 8a822d4a45adb86fc693aaf01258c1bf
- SHA1 e8ee84780784f75d700631593fa738e90cfdfa4f
- SHA512 30d01f414c7f133601ecc12c5a1b9575bc6fdf412d7eeefbdfe3dcb594fdc9422e572a3c70a7f4e70aa0f7ddcf74c7dc52fdef019cd7845c0305943d0ab49002
- SSDEEP 98304:g2BpyXvrncP77PHkuXSvHrEIkLVK5BsT2Khh1QibhFHLNONCdxBYvYHiZGSjg/ZK:OXwPESM7kU5BQbRPHaCzBMYCwCgRZM
- TLSH T147363354739150F8CB27C0399AD04645E23678451773DEEB5311AAAAAF22FE18D3FF22
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x00080000000245f7-15.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
pid Process 2888 powershell.exe 5872 powershell.exe 5080 powershell.exe 5620 powershell.exe 6068 powershell.exe 5536 powershell.exe 2404 powershell.exe 5376 powershell.exe 5912 powershell.exe 2192 powershell.exe 5428 powershell.exe - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk powershell.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AspergillusNiger.lnk powershell.exe - Executes dropped EXE 5 IoCs
pid Process 5436 corehost.exe 6112 corehost.exe 4172 corehost.exe 1152 corehost.exe 4540 WindowsProcessor.exe - Loads dropped DLL 64 IoCs
pid Process 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\WindowsConsole\\corehost.exe" 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\WindowsConsole\\corehost.exe" 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\WindowsConsole\\WindowsProcessor.exe" 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\WindowsConsole\\WindowsProcessor.exe" 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe - Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 6 raw.githubusercontent.com 7 raw.githubusercontent.com 18 raw.githubusercontent.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5780 cmd.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 WindowsProcessor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WindowsProcessor.exe - Kills process with taskkill 2 IoCs
pid Process 2904 taskkill.exe 6132 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 powershell.exe 2888 powershell.exe 6068 powershell.exe 6068 powershell.exe 5536 powershell.exe 5536 powershell.exe 2404 powershell.exe 2404 powershell.exe 5376 powershell.exe 5376 powershell.exe 5912 powershell.exe 5912 powershell.exe 5620 powershell.exe 5620 powershell.exe 5428 powershell.exe 5428 powershell.exe 5872 powershell.exe 5872 powershell.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 4172 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 1152 corehost.exe 4172 corehost.exe 4172 corehost.exe 2192 powershell.exe 2192 powershell.exe 2192 powershell.exe 5080 powershell.exe 5080 powershell.exe 5080 powershell.exe 1152 corehost.exe 1152 corehost.exe 4172 corehost.exe 4172 corehost.exe 1152 corehost.exe 1152 corehost.exe 4172 corehost.exe 4172 corehost.exe 1152 corehost.exe 1152 corehost.exe 4172 corehost.exe 4172 corehost.exe 1152 corehost.exe 1152 corehost.exe 4172 corehost.exe 4172 corehost.exe 1152 corehost.exe 1152 corehost.exe 4172 corehost.exe 4172 corehost.exe 1152 corehost.exe 1152 corehost.exe 4172 corehost.exe 4172 corehost.exe 1152 corehost.exe 4172 corehost.exe 1152 corehost.exe 4172 corehost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2888 powershell.exe Token: SeDebugPrivilege 6068 powershell.exe Token: SeDebugPrivilege 5536 powershell.exe Token: SeDebugPrivilege 2404 powershell.exe Token: SeDebugPrivilege 5376 powershell.exe Token: SeDebugPrivilege 5912 powershell.exe Token: SeDebugPrivilege 5620 powershell.exe Token: SeDebugPrivilege 2904 taskkill.exe Token: SeDebugPrivilege 5428 powershell.exe Token: SeIncreaseQuotaPrivilege 5428 powershell.exe Token: SeSecurityPrivilege 5428 powershell.exe Token: SeTakeOwnershipPrivilege 5428 powershell.exe Token: SeLoadDriverPrivilege 5428 powershell.exe Token: SeSystemProfilePrivilege 5428 powershell.exe Token: SeSystemtimePrivilege 5428 powershell.exe Token: SeProfSingleProcessPrivilege 5428 powershell.exe Token: SeIncBasePriorityPrivilege 5428 powershell.exe Token: SeCreatePagefilePrivilege 5428 powershell.exe Token: SeBackupPrivilege 5428 powershell.exe Token: SeRestorePrivilege 5428 powershell.exe Token: SeShutdownPrivilege 5428 powershell.exe Token: SeDebugPrivilege 5428 powershell.exe Token: SeSystemEnvironmentPrivilege 5428 powershell.exe Token: SeRemoteShutdownPrivilege 5428 powershell.exe Token: SeUndockPrivilege 5428 powershell.exe Token: SeManageVolumePrivilege 5428 powershell.exe Token: 33 5428 powershell.exe Token: 34 5428 powershell.exe Token: 35 5428 powershell.exe Token: 36 5428 powershell.exe Token: SeIncreaseQuotaPrivilege 5428 powershell.exe Token: SeSecurityPrivilege 5428 powershell.exe Token: SeTakeOwnershipPrivilege 5428 powershell.exe Token: SeLoadDriverPrivilege 5428 powershell.exe Token: SeSystemProfilePrivilege 5428 powershell.exe Token: SeSystemtimePrivilege 5428 powershell.exe Token: SeProfSingleProcessPrivilege 5428 powershell.exe Token: SeIncBasePriorityPrivilege 5428 powershell.exe Token: SeCreatePagefilePrivilege 5428 powershell.exe Token: SeBackupPrivilege 5428 powershell.exe Token: SeRestorePrivilege 5428 powershell.exe Token: SeShutdownPrivilege 5428 powershell.exe Token: SeDebugPrivilege 5428 powershell.exe Token: SeSystemEnvironmentPrivilege 5428 powershell.exe Token: SeRemoteShutdownPrivilege 5428 powershell.exe Token: SeUndockPrivilege 5428 powershell.exe Token: SeManageVolumePrivilege 5428 powershell.exe Token: 33 5428 powershell.exe Token: 34 5428 powershell.exe Token: 35 5428 powershell.exe Token: 36 5428 powershell.exe Token: SeIncreaseQuotaPrivilege 5428 powershell.exe Token: SeSecurityPrivilege 5428 powershell.exe Token: SeTakeOwnershipPrivilege 5428 powershell.exe Token: SeLoadDriverPrivilege 5428 powershell.exe Token: SeSystemProfilePrivilege 5428 powershell.exe Token: SeSystemtimePrivilege 5428 powershell.exe Token: SeProfSingleProcessPrivilege 5428 powershell.exe Token: SeIncBasePriorityPrivilege 5428 powershell.exe Token: SeCreatePagefilePrivilege 5428 powershell.exe Token: SeBackupPrivilege 5428 powershell.exe Token: SeRestorePrivilege 5428 powershell.exe Token: SeShutdownPrivilege 5428 powershell.exe Token: SeDebugPrivilege 5428 powershell.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4988 wrote to memory of 3056 4988 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 84 PID 3056 wrote to memory of 5780 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 85 PID 3056 wrote to memory of 2888 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 87 PID 3056 wrote to memory of 6068 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 89 PID 3056 wrote to memory of 5536 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 91 PID 3056 wrote to memory of 2404 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 94 PID 3056 wrote to memory of 5376 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 96 PID 3056 wrote to memory of 5912 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 98 PID 3056 wrote to memory of 5620 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 102 PID 3056 wrote to memory of 2904 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 104 PID 3056 wrote to memory of 5428 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 111 PID 3056 wrote to memory of 5872 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 114 PID 3056 wrote to memory of 6112 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 118 PID 3056 wrote to memory of 6132 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 119 PID 5436 wrote to memory of 4172 5436 corehost.exe 121 PID 6112 wrote to memory of 1152 6112 corehost.exe 122 PID 3056 wrote to memory of 2192 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 125 PID 3056 wrote to memory of 5080 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 127 PID 3056 wrote to memory of 4540 3056 2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exeC:\Users\Admin\AppData\Local\Temp\2026-09-06_8a822d4a45adb86fc693aaf01258c1bf_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vol C:"3⤵
- Executes a command shell one-liner
PID:5780
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-MpPreference | Select-Object -ExpandProperty ExclusionPath"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsConsole' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6068
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsConsole\cache_1' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsConsole\cache_2' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsConsole\cache_3' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5376
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsConsole\cache_4' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5912
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsConsole\cache_5' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5620
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM corehost.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\WindowsConsole\corehost.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogOn -User 'SYSTEM'; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'WindowsUpdate_sz82rv' -Action $Action -Trigger $Trigger -Settings $Settings -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5428
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\WindowsConsole\corehost.exe'; $Shortcut.WorkingDirectory = 'C:\Users\Admin\AppData\Local\WindowsConsole'; $Shortcut.Save()"3⤵
- Command and Scripting Interpreter: PowerShell
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
PID:5872
-
-
C:\Users\Admin\AppData\Local\WindowsConsole\corehost.exeC:\Users\Admin\AppData\Local\WindowsConsole\corehost.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\WindowsConsole\corehost.exeC:\Users\Admin\AppData\Local\WindowsConsole\corehost.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1152
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM WindowsProcessor.exe3⤵
- Kills process with taskkill
PID:6132
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\WindowsConsole\WindowsProcessor.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogOn -User 'SYSTEM'; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'WindowsUpdate_onorrj' -Action $Action -Trigger $Trigger -Settings $Settings -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AspergillusNiger.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\WindowsConsole\WindowsProcessor.exe'; $Shortcut.WorkingDirectory = 'C:\Users\Admin\AppData\Local\WindowsConsole'; $Shortcut.Save()"3⤵
- Command and Scripting Interpreter: PowerShell
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
-
C:\Users\Admin\AppData\Local\WindowsConsole\WindowsProcessor.exeC:\Users\Admin\AppData\Local\WindowsConsole\WindowsProcessor.exe3⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4540
-
-
-
C:\Users\Admin\AppData\Local\WindowsConsole\corehost.exeC:\Users\Admin\AppData\Local\WindowsConsole\corehost.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\WindowsConsole\corehost.exeC:\Users\Admin\AppData\Local\WindowsConsole\corehost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4172
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- TLSH T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 e1ee9af6b9e3bfd41b7d2c980580bb7427883f1169ed3df4be11293ce7895465
- MD5 dbb22d95851b93abf2afe8fb96a8e544
- SHA1 920ec5fdb323537bcf78f7e29a4fc274e657f7a4
- SHA512 16031134458bf312509044a3028be46034c544163c4ca956aee74d2075fbeb5873754d2254dc1d0b573ce1a644336ac4c8bd7147aba100bfdac8c504900ef3fc
- TLSH T1AC112223F38C89A1CC961639509DAC5172B686CB81AEDEDF7FC0C210E1AF584CB61294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5
- MD5 da5c82b0e070047f7377042d08093ff4
- SHA1 89d05987cd60828cca516c5c40c18935c35e8bd3
- SHA512 7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b
- TLSH T123112223F38C8920CC961539509DAC5172B586CB81AFDE9F7FC0D210A1BF584CB61294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4c8c27cf1b58cbec6065ecb50c3fd39f42eb4952d4616675f6ec78fa610af69a
- MD5 a3769556f94ca1911a37ee62b7576309
- SHA1 ee4a76db693ef09546a70c96507ca1332ad4b21a
- SHA512 3a3c1aac1d7c463b3224745cc3f99b36088d4e2ae3af16fddcf80be9593700676dddcb2e565ea8e8dfc7699e4eefff5dd3f15ad3aec2280829a4919cd6230368
- TLSH T170217823B39D8460CCD5163A108D9C5072A782C781DECFDB2EC0C21191BFAC8CB61190
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 d0965a652ccd96ddd5530f46518a4fe2cbeb2b3ccbcf9ddae0c4e5e0d0222731
- MD5 36dba3dcef53e78246b64363c04f6bf7
- SHA1 a3f87007dded114ebb22c6e039e34d0102a4ae0b
- SHA512 c75e5b55ee642a21e16a91de0ac21aa076f7f1f9b6246f1a818e93c9aa5f29bafee568fb13b65f88303d451db3f9ea6b6b0b07d1933244e5c580d39c9228944d
- TLSH T1B3112227F38C89A1CC961639509DAC5172B686CB81AEDFDF7FC0C210E5AF584CB61294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c
- MD5 dd1d0b083fedf44b482a028fb70b96e8
- SHA1 dc9c027937c9f6d52268a1504cbae42a39c8d36a
- SHA512 96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973
- TLSH T11E112223F78C8920CC961539509DAC5172B586CB81AFDE9F7FC0C210E1BF584CBA21D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
- MD5 d8cb3e9459807e35f02130fad3f9860d
- SHA1 5af7f32cb8a30e850892b15e9164030a041f4bd6
- SHA512 045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184
- TLSH T13F112223F38C8920CC961539509DAC5172B686CB81AFDE9F7FC0C210A1BF584CB611D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14
- MD5 10890cda4b6eab618e926c4118ab0647
- SHA1 1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d
- SHA512 a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221
- TLSH T15F112223F38C8921CC961539509DAC5172B586CB81AFDE9F7FC0D210A1BF584CBA11D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51
- MD5 98baf5117c4fcec1692067d200c58ab3
- SHA1 5b33a57b72141e7508b615e17fb621612cb8e390
- SHA512 344a70bfc037d54176f12db91f05bf4295bb587a5062fd1febe6f52853571170bd8ef6042cb87b893185bbae1937cf77b679d7970f8cc1c2666b0b7c1b32987d
- TLSH T1B3112223F78C8920CC961639509DAC5172B986CB81AFDE9F7FC0D210A1BF584CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tgcugb2s.vn3.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\_bz2.pyd
- Size 81KB
- SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
- MD5 86d1b2a9070cd7d52124126a357ff067
- SHA1 18e30446fe51ced706f62c3544a8c8fdc08de503
- SHA512 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535
- SSDEEP 1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
- TLSH T160838D92B3A458B5F05BA27955B10357E371F90D03A0D3EFB758826B2F03B826D6432E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\_ctypes.pyd
- Size 120KB
- SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
- MD5 1635a0c5a72df5ae64072cbb0065aebe
- SHA1 c975865208b3369e71e3464bbcc87b65718b2b1f
- SHA512 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99
- SSDEEP 3072:0OEESRiaiH6lU1vxqfrId0sx3gVILLPykxA:hj+I1vAfrIRx3gN
- TLSH T10BC36C0B2358109AEB674078C5B35E47DB71B859171087CF0264C69E2F63BA36E7F716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\_hashlib.pyd
- Size 63KB
- SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
- MD5 d4674750c732f0db4c4dd6a83a9124fe
- SHA1 fd8d76817abc847bb8359a7c268acada9d26bfd5
- SHA512 97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e
- SSDEEP 1536:/smKJPganCspF1dqZAC2QjP2RILOIld7SyEPxDF:/smKpgNoF1dqZDnjP2RILOIv2xB
- TLSH T1A8537C06A78440A5C467837DD9D30EABE272F4405751A7EF4368C28E2F237C3A7B67A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\_lzma.pyd
- Size 154KB
- SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
- MD5 7447efd8d71e8a1929be0fac722b42dc
- SHA1 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6
- SHA512 c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de
- SSDEEP 3072:j0k3SXjD9aWpAn3rb7SbuDlvNgS4fWqEznfo9mNoFTSlXZ8Ax5ILZ1GIxq:j0kiXjD9v8X7Euk4wYOFTafxn
- TLSH T171F32992A394F0E6F3628C78D6624F57D6F57809031092DA02CC976D2B1FB759E2E327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\_socket.pyd
- Size 77KB
- SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
- MD5 819166054fec07efcd1062f13c2147ee
- SHA1 93868ebcd6e013fda9cd96d8065a1d70a66a2a26
- SHA512 da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666
- SSDEEP 1536:ZmtvsXhgzrojAs9/s+S+pGLypbyxk/DDTBVILLwX7SyiPx9:c56OzyAs9/sT+pGLypb+k/XFVILLwX4f
- TLSH T137736B12A69050A9D27380BAC5635F63F770F48057D593CF1264CA6E1F23782AE7EBD2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\_ssl.pyd
- Size 156KB
- SHA256 d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f
- MD5 7910fb2af40e81bee211182cffec0a06
- SHA1 251482ed44840b3c75426dd8e3280059d2ca06c6
- SHA512 bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27
- SSDEEP 3072:OwYiZ+PtocHnVXhLlasuvMETxoEBA+nbUtGnBSonJCNI5ILC7Gax1:FYk+PtocHVxx/uvPCEwhGJ
- TLSH T11BF38D47F28429ABE813E4BDC6634912EBB5F045231187CE45D6C68A0F13746AF7AF63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\dropper2.0.dll
- Size 4.1MB
- SHA256 7c2013ac57f76c651dac83413b4ae6b4a86e6adc67d6d2a35c998e1c40af40b6
- MD5 2b267bd2f9b3605df76baf0f4bdcc9f4
- SHA1 d7aed2490ea98c16421457a39bafd70c67b03ccb
- SHA512 ca90bf5ad60327e8d2b0cfb492cba43229bbf59470a20fc9c2c2b8638ac9b2cdb8113057a6e7a09388c7e88b69f6e691f4b46b6b5db84fb74f550fd3cc1ff414
- SSDEEP 49152:P4kOTs9dgT69XX4wyc6+ae4Gc4caM6exovYa21J8cUvB3YiJHEjad4M45rBoUBcB:zhvy8cUmiJHEjad4M45rBoUBcg16
- TLSH T12B165AD176B11EABFD52F2B880CF42209726E23B2B489993F04CC29E3F466D45D7569C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\libcrypto-1_1.dll
- Size 3.3MB
- SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
- MD5 9d7a0c99256c50afd5b0560ba2548930
- SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
- SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
- SSDEEP 98304:YP+uemAdn67xfxw6rKsK1CPwDv3uFfJz1CmiX:OZemAYxfxw6HK1CPwDv3uFfJzUmA
- TLSH T1CEF58C5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF18B681780F13BD6363DB44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\libffi-7.dll
- Size 32KB
- SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
- MD5 eef7981412be8ea459064d3090f4b3aa
- SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
- SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
- SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
- TLSH T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\libssl-1_1.dll
- Size 688KB
- SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
- MD5 bec0f86f9da765e2a02c9237259a7898
- SHA1 3caa604c3fff88e71f489977e4293a488fb5671c
- SHA512 ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4
- SSDEEP 12288:WhO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0TGqwfU2lvz2:2is/POtrzbLp5dQ0TGqcU2lvz2
- TLSH T197E44B95ABB51498D5E6C17C8A534A33E3BBF4141330AFCB06A5893E0F177C92B3A758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\python310.dll
- Size 4.3MB
- SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
- MD5 63a1fa9259a35eaeac04174cecb90048
- SHA1 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a
- SHA512 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b
- SSDEEP 49152:myrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbH3:Uw5tVBlicWdvoDkHUMF7Ph/qe
- TLSH T102267C26A36401A4D9B79477C523864BCBF1FC442F24D34A41A4BAD92F73BA317EE706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\select.pyd
- Size 29KB
- SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
- MD5 a653f35d05d2f6debc5d34daddd3dfa1
- SHA1 1a2ceec28ea44388f412420425665c3781af2435
- SHA512 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9
- SSDEEP 768:gUC2hwhVHqOmEVILQG35YiSyvrYPxWEl6:FC2ehVKOmEVILQGp7SyEPxe
- TLSH T1FED2AF47AB506C42D8238572A4D68E16E935B6A14B20C3DF332DC26D1F227C277BB36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\unicodedata.pyd
- Size 1.1MB
- SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
- MD5 81d62ad36cbddb4e57a91018f3c0816e
- SHA1 fe4a4fc35df240b50db22b35824e4826059a807b
- SHA512 7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d
- SSDEEP 12288:6mwlRMmuZ63NTQCb5Pfhnzr0ql8L8kcM7IRG5eeme6VZyrIBHdQLhfFE+uQfk:ulRuUZV0m8UMMREtV6Vo4uYQfk
- TLSH T16E355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_4988_324908_PnocPq5N1yE\vcruntime140.dll
- Size 95KB
- SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
- MD5 f34eb034aa4a9735218686590cba2e8b
- SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
- SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
- SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
- TLSH T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_5436_329527_7t-wlITaROs\_socket.pyd
- Size 85KB
- SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
- MD5 7a16a21ad11d3e9829ca3b379a2bb010
- SHA1 90707b5c1662a1e4553f1cc10ba96c7452def7c2
- SHA512 5e0268af7dad1646903ddb5e61fb38896a7ae964cadb38b5c28bc1524a69a87b7c09f501f3f570ec6bf78c8fa873b8fbe062bbe06cf839e32a2735f1efd0cae1
- SSDEEP 1536:hcVuncT0XH3XAJtZypxm7XP+66wSzC/jAjI/Lb6NsQ3cs8PgMr8IGGwby1Ni9DFo:SEny2+jypxm7XPz6wSzC/jAjQOsQssV2
- TLSH T19B835B01A66040FAEB77C176C2639E63FBB4B5C01294A75F1466C55A1F333C2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_5436_329527_7t-wlITaROs\_ssl.pyd
- Size 186KB
- SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
- MD5 e4ba5a52f5fa2a64baec46486cbdcf82
- SHA1 ff213b504a70d50871eb8432cea1b22563364cb4
- SHA512 111c926a0157d46c48a26da30face546b065eb4afddb6dcf27442fd4f73432808de43978f78f5b297b22a63d82d0d5bf305701e137f6060f59cbd601012e61fa
- SSDEEP 3072:FVpZeIk2MZ7IifVvQto7qrvYLrgp8VuMG4eJ9i1zktdsQ/3Omca45gMqTVBOrQII:Bxk2MZZVvQtmL4457qTVMrQ
- TLSH T1AD147B47B5446EF7D802E8BAC6234543FBB4F045331297DE48D6EA520F03746AE6AB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_5436_329527_7t-wlITaROs\_zstd.pyd
- Size 491KB
- SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
- MD5 035b0a033dd00dbe887556f4d4b852c3
- SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
- SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
- SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
- TLSH T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_5436_329527_7t-wlITaROs\libcrypto-3.dll
- Size 6.0MB
- SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
- MD5 4191d4288230515c5098cc07f699a604
- SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
- SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
- SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
- TLSH T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_5436_329527_7t-wlITaROs\libssl-3.dll
- Size 1.3MB
- SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
- MD5 d99207e7e513f87ad7571c4c2450771b
- SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
- SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
- SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
- TLSH T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_5436_329527_7t-wlITaROs\psutil\_psutil_windows.pyd
- Size 69KB
- SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
- MD5 0a66d22d2ac4f9d41e1605b8d05de77b
- SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
- SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
- SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
- TLSH T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_5436_329527_7t-wlITaROs\python3.dll
- Size 72KB
- SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
- MD5 a5495a547b4218148914469f1ee65d47
- SHA1 91632b2965ae22db25edce6971cf59c0a3a00bba
- SHA512 ab1fe6ec0b21fdac78b17afc0fd3a7573b89647a3e4af846448e285a7989342f4a8eaf191a4e90e81a990f10ff1364dd941a0c7f80c108224d8f6c7cf6bb49d1
- SSDEEP 768:xHQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKp:0bTrnXngXMu8IGG0ly1Ni94fIk0h4
- TLSH T168735D4E6B54F8A2DAB629FC78D199CE242B12FC5F2584DFA47CD3D20D1A310A22735D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_5436_329527_7t-wlITaROs\python314.dll
- Size 6.5MB
- SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
- MD5 006b0746b5abaf438d1bc753261c6d2c
- SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
- SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
- SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
- TLSH T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_5436_329527_7t-wlITaROs\rose2aberbesser2.dll
- Size 16.3MB
- SHA256 d8524db395d70b7bbe2ebe3e56c05f0b0778464ccd7e16085e825319b53e0fec
- MD5 f2226c04fb980b9161c30a1e0b4ae013
- SHA1 0a1fdff9c467288ddc238ce74cee9ac4a2e5ba40
- SHA512 88da12945ae6b726a7551a18dff117eea4d8ff1d17dbdb842b2503cad78069e00adc9638bb2d67ff5f5172a985e6e2118488703442e2a1e38d15c24a3e84f5cb
- SSDEEP 196608:eHr7pvsHjH5sSMYucOgavnj1o5u6Y92kELoA:eHrxYstYMj1n2kEL
- TLSH T172074D1272B51013FBF7E0755F6AA593DF30F44AD320D393A82898BA2F86E715F64258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_5436_329527_7t-wlITaROs\vcruntime140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\WindowsConsole\corehost.exe
- Size 12.1MB
- SHA256 4355a7f04748108c3a2a03abe3fceb9e4b8fa1549fa4a43d7ca2f04cfbcb9af7
- MD5 cfab6b1b8991e27c290c8b0c5f9e37ef
- SHA1 1720e26b0eb4479d333d03183e7e10534a1404e5
- SHA512 bc89d44f73478fb5fcb18ce541e1baa7f0886e4359a3a1413e0528acb4d426a75c60d84a9f2c2bcdaf48eb2ef85d3edd607b011bba5b07f2707282f63fb1bd69
- SSDEEP 196608:lKncIvQzp8tggjtaa0IwNNzVfXaVLajadzlN5jxmkv+M5cdUJv:lKnvxFb0IUNzVfXaVLas/mkR5cdI
- TLSH T198D63395A78541E3C5636634C55086627B7E79130BA2C0CB0BF9A2F72F43AE05E3A737
- MD5 SHA1 SHA512 SSDEEP TLSH