Overview

overview

10

Static

static

10

2026-09-07...om.exe

windows10-2004-x64

10

2026-09-07...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/09/2026, 23:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  • Size 1.4MB
  • Sample260907-3pht7axfna
  • SHA256 73e428db78967ea77eb1d4eef8bed215ec4f54612c3f47ed2fb5c453dd42e51d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://discord.com/api/webhooks/1518686631891308636/eUp_1qLCJQhFL33VphUtau7Wn1NzCqQvoDr6UAHDFe4mS8sOpspZKHjIhyvo-PlKAVCl

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://discord.com/api/webhooks/1518686631891308636/eUp_1qLCJQhFL33VphUtau7Wn1NzCqQvoDr6UAHDFe4mS8sOpspZKHjIhyvo-PlKAVCl

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Creates a file in the Startup directory 1 TTPs 3 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 18 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Collects information from the system 1 TTPs 2 IoCs

    Uses WMIC.exe to find detailed system information.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
    1⤵
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2600
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn WindowsSystemUpdate /tr C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe /sc onlogon /ru SYSTEM /rl highest /f /it
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4576
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn WindowsSystemUpdateDaily /tr C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe /sc daily /mo 1 /f /it
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3568
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /c "ipconfig | findstr /i \"ipv4\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\system32\ipconfig.exe
        ipconfig
        3⤵
        • Gathers network information
        PID:3124
      • C:\Windows\system32\findstr.exe
        findstr /i \"ipv4\"
        3⤵
          PID:2784
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c "wmic os get caption /value"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:216
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic os get caption /value
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3876
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c "wmic cpu get name /value"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4508
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic cpu get name /value
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4612
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c "wmic path win32_videocontroller get name /value"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_videocontroller get name /value
          3⤵
          • Detects videocard installed
          PID:5084
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c "wmic ComputerSystem get TotalPhysicalMemory /value"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3448
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic ComputerSystem get TotalPhysicalMemory /value
          3⤵
            PID:4432
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /c "wmic logicaldisk get size,freespace,caption /value"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2988
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic logicaldisk get size,freespace,caption /value
            3⤵
            • Collects information from the system
            PID:1228
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /c "wmic product get name /value"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2404
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic product get name /value
            3⤵
              PID:2100
          • C:\Windows\system32\cmd.exe
            "cmd.exe" /c "tasklist /v /fo csv /nh"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2788
            • C:\Windows\system32\tasklist.exe
              tasklist /v /fo csv /nh
              3⤵
              • Discovers running processes
              • Suspicious behavior: EnumeratesProcesses
              PID:4364
          • C:\Windows\system32\cmd.exe
            "cmd.exe" /c "netsh wlan show profiles"
            2⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:1228
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:2420
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -NoP -NonI -W Hidden -ExecutionPolicy Bypass -F C:\Users\Admin\AppData\Local\Temp\u2600.ps1
            2⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:5032
        • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
          C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
          1⤵
          • Creates a file in the Startup directory
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Windows\system32\schtasks.exe
            "schtasks" /create /tn WindowsSystemUpdate /tr C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe /sc onlogon /ru SYSTEM /rl highest /f /it
            2⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3772
          • C:\Windows\system32\schtasks.exe
            "schtasks" /create /tn WindowsSystemUpdateDaily /tr C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe /sc daily /mo 1 /f /it
            2⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2432
          • C:\Windows\system32\cmd.exe
            "cmd.exe" /c "ipconfig | findstr /i \"ipv4\""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4100
            • C:\Windows\system32\ipconfig.exe
              ipconfig
              3⤵
              • Gathers network information
              PID:4724
            • C:\Windows\system32\findstr.exe
              findstr /i \"ipv4\"
              3⤵
                PID:3372
            • C:\Windows\system32\cmd.exe
              "cmd.exe" /c "wmic os get caption /value"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3236
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic os get caption /value
                3⤵
                  PID:4344
              • C:\Windows\system32\cmd.exe
                "cmd.exe" /c "wmic cpu get name /value"
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:3636
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic cpu get name /value
                  3⤵
                    PID:4788
                • C:\Windows\system32\cmd.exe
                  "cmd.exe" /c "wmic path win32_videocontroller get name /value"
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2372
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic path win32_videocontroller get name /value
                    3⤵
                    • Detects videocard installed
                    PID:4224
                • C:\Windows\system32\cmd.exe
                  "cmd.exe" /c "wmic ComputerSystem get TotalPhysicalMemory /value"
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3088
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic ComputerSystem get TotalPhysicalMemory /value
                    3⤵
                      PID:1372
                  • C:\Windows\system32\cmd.exe
                    "cmd.exe" /c "wmic logicaldisk get size,freespace,caption /value"
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:2640
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic logicaldisk get size,freespace,caption /value
                      3⤵
                      • Collects information from the system
                      PID:4576
                  • C:\Windows\system32\cmd.exe
                    "cmd.exe" /c "wmic product get name /value"
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:3176
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic product get name /value
                      3⤵
                        PID:4680
                    • C:\Windows\system32\cmd.exe
                      "cmd.exe" /c "tasklist /v /fo csv /nh"
                      2⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3188
                      • C:\Windows\system32\tasklist.exe
                        tasklist /v /fo csv /nh
                        3⤵
                        • Discovers running processes
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2312
                    • C:\Windows\system32\cmd.exe
                      "cmd.exe" /c "netsh wlan show profiles"
                      2⤵
                      • Executes a command shell one-liner
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3564
                      • C:\Windows\system32\netsh.exe
                        netsh wlan show profiles
                        3⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:1820
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -NoP -NonI -W Hidden -ExecutionPolicy Bypass -F C:\Users\Admin\AppData\Local\Temp\u2280.ps1
                      2⤵
                      • Badlisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2268
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --system-dpapi-raw "C:\Users\Public\dpapi_blob_2600.bin"
                    1⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2624
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --system-dpapi-raw "C:\Users\Public\dpapi_blob_2600.bin"
                    1⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:392
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --cng-decrypt-raw "C:\Users\Public\cng_blob_2600.bin"
                    1⤵
                      PID:2612
                    • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                      "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --system-dpapi-raw "C:\Users\Public\dpapi_blob_2280.bin"
                      1⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3508
                    • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                      "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --cng-decrypt-raw "C:\Users\Public\cng_blob_2600.bin"
                      1⤵
                        PID:3256
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --cng-decrypt-raw "C:\Users\Public\cng_blob_2280.bin"
                        1⤵
                          PID:1068
                        • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                          "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --system-dpapi-raw "C:\Users\Public\dpapi_blob_2600.bin"
                          1⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4488
                        • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                          "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --system-dpapi-raw "C:\Users\Public\dpapi_blob_2600.bin"
                          1⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2176
                        • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                          "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --cng-decrypt-raw "C:\Users\Public\cng_blob_2600.bin"
                          1⤵
                            PID:3060
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --cng-decrypt-raw "C:\Users\Public\cng_blob_2600.bin"
                            1⤵
                              PID:4836
                            • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                              "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --system-dpapi-raw "C:\Users\Public\dpapi_blob_2600.bin"
                              1⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1808
                            • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                              "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --system-dpapi-raw "C:\Users\Public\dpapi_blob_2600.bin"
                              1⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4916
                            • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                              "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --cng-decrypt-raw "C:\Users\Public\cng_blob_2600.bin"
                              1⤵
                                PID:2464
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --cng-decrypt-raw "C:\Users\Public\cng_blob_2600.bin"
                                1⤵
                                  PID:1140
                                • C:\Windows\system32\msiexec.exe
                                  C:\Windows\system32\msiexec.exe /V
                                  1⤵
                                    PID:1268

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Command and Scripting Interpreter

                                        3
                                        T1059

                                        PowerShell

                                        1
                                        T1059.001

                                        Windows Command Shell

                                        1
                                        T1059.003

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        2
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        2
                                        T1547.001

                                        Event Triggered Execution

                                        1
                                        T1546

                                        Netsh Helper DLL

                                        1
                                        T1546.007

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        2
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        2
                                        T1547.001

                                        Event Triggered Execution

                                        1
                                        T1546

                                        Netsh Helper DLL

                                        1
                                        T1546.007

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Defense Evasion

                                        Modify Registry

                                        1
                                        T1112

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Unsecured Credentials

                                        5
                                        T1552

                                        Credentials In Files

                                        5
                                        T1552.001

                                        Discovery

                                        Browser Information Discovery

                                        1
                                        T1217

                                        Process Discovery

                                        1
                                        T1057

                                        Query Registry

                                        1
                                        T1012

                                        System Information Discovery

                                        2
                                        T1082

                                        System Network Configuration Discovery

                                        1
                                        T1016

                                        Wi-Fi Discovery

                                        1
                                        T1016.002

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        5
                                        T1005

                                        Command and Control

                                        Web Service

                                        1
                                        T1102

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        powershell.exe.log
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                        • Size 2KB
                                        • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 db302e3395be275f4212deebf1da3e866a7bd5e1d72b53387dd354bc3aaef123
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        __PSScriptPolicyTest_nntssxup.lkp.ps1
                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nntssxup.lkp.ps1
                                        • Size 60B
                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        b2600.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\b2600.tmp
                                        • Size 204KB
                                        • SHA256 e9e57e94fb6d261442f526061c89365afa4b656eb14cd0bba96f15677a0270e1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        b2600.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\b2600.tmp
                                        • Size 204KB
                                        • SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        fb2600.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\fb2600.tmp
                                        • Size 5.0MB
                                        • SHA256 e5547bcac202685601a87f0491a0bd67cb87815c9dddbe86bad398a15042e282
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        fc2280.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\fc2280.tmp
                                        • Size 96KB
                                        • SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        stolen_data_dump.json
                                        • Path C:\Users\Admin\AppData\Local\Temp\stolen_data_dump.json
                                        • Size 22KB
                                        • SHA256 8a576d55ed35ef4ef906500f5b00b28b0667872dc9975773eab6c1715b7ac884
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        u2280.ps1
                                        • Path C:\Users\Admin\AppData\Local\Temp\u2280.ps1
                                        • Size 30KB
                                        • SHA256 015d94de2f62374107eafa579027f84d7558b4be2b2893f65cd436e1b535d7d1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        u2600.ps1
                                        • Path C:\Users\Admin\AppData\Local\Temp\u2600.ps1
                                        • Size 30KB
                                        • SHA256 7888c953222bca0a24bfe34034eaf759b72a397918dd4c25e24321912af7ce73
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        WindowsSystemUpdate.exe
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemUpdate.exe
                                        • Size 1.4MB
                                        • SHA256 73e428db78967ea77eb1d4eef8bed215ec4f54612c3f47ed2fb5c453dd42e51d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cng_blob_2600.bin
                                        • Path C:\Users\Public\cng_blob_2600.bin
                                        • Size 32B
                                        • SHA256 9c17571b616d35214d8158ccc1b7dfb97f839b477abd97bf1dc9974e61478533
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        cng_system_result.bin
                                        • Path C:\Users\Public\cng_system_result.bin
                                        • Size 32B
                                        • SHA256 4c7e11407c6e91bf26a2259a51b6517c6cf06c2ad99e61022dc4adcb7e4717f8
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        dpapi_blob_2600.bin
                                        • Path C:\Users\Public\dpapi_blob_2600.bin
                                        • Size 640B
                                        • SHA256 99e82899c19ac5cbeae43397cc53d96ab68a2122bda0f6bcb18e2ecffaee7bdb
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        dpapi_system_result.bin
                                        • Path C:\Users\Public\dpapi_system_result.bin
                                        • Size 384B
                                        • SHA256 f43ae95dce56959d219b6222946ccafa7ca4487f12d6c4028689c14618f2a4b3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        memory/2268-141-0x00000280BCE50000-0x00000280BCF52000-memory.dmp
                                        Download

                                        memory/5032-134-0x0000028FC0160000-0x0000028FC0182000-memory.dmp
                                        Download

                                        memory/5032-145-0x0000028FC07C0000-0x0000028FC08C2000-memory.dmp
                                        Download