370d7f2aa57180676dbb396f340aa2a4034bab5def06c4da2a808b214b015b63

Analysis

max time kernel
151s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Size 31.5MB
Sample260925-yeemkaws7q
SHA256 370d7f2aa57180676dbb396f340aa2a4034bab5def06c4da2a808b214b015b63
MD5 ca510354d234468e673fa934a24a06b5
SHA1 01bb7f39f2db184fc68963620f7edd12ad6ab718
SHA512 6f3096858f55157ccab2f166aef202ff990ce5f6f3231a3080fcfd2473a2d4e44ebe6b2a16749bc2fa6a5b40f6795b5e6c70c965df52307e7d118e3902dc2ce0
SSDEEP 393216:qQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgF96l+ZArYsFRl4W:q3on1HvSzxAMNFFZArYsgW
TLSH
T1D6778D03B2A501E6E4B7D13889A74203E772B8674735CBCF325D02161FBBAD09A7E765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3424 created 1416	3424	AppManagerServicef7ad.exe	81
PID 3232 created 1416	3232	fwh0oesi71.exe	81

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 7 IoCs

resource	yara_rule
behavioral2/memory/4516-198-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1244-296-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1244-317-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1244-318-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1244-319-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1244-320-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1244-321-0x0000000140000000-0x00000001404C4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Command and Scripting Interpreter: PowerShell 1 TTPs 30 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5108	powershell.exe
1568	powershell.exe
1300	powershell.exe
2872	powershell.exe
4520	powershell.exe
5540	powershell.exe
1260	powershell.exe
2512	powershell.exe
3900	powershell.exe
2860	powershell.exe
4484	powershell.exe
3700	powershell.exe
4116	powershell.exe
1012	powershell.exe
3968	powershell.exe
2332	powershell.exe
3900	powershell.exe
2872	powershell.exe
1260	powershell.exe
4660	powershell.exe
2512	powershell.exe
4520	powershell.exe
3700	powershell.exe
2952	powershell.exe
5108	powershell.exe
1300	powershell.exe
1568	powershell.exe
2860	powershell.exe
4484	powershell.exe
5540	powershell.exe

Downloads MZ/PE file 12 IoCs

flow	pid	Process
28	2868	SecurityHealthHost.exe
15	476	SecurityHealthHost.exe
16	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
17	476	SecurityHealthHost.exe
19	476	SecurityHealthHost.exe
22	2868	SecurityHealthHost.exe
29	2868	SecurityHealthHost.exe
30	2868	SecurityHealthHost.exe
11	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
12	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
13	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
18	476	SecurityHealthHost.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 24 IoCs

pid	Process
2868	SecurityHealthHost.exe
476	SecurityHealthHost.exe
1172	z6wb0rbwhe7u.exe
5596	NetHost1dcc90.exe
4516	z8svu6vd3.exe
6060	wehyjz07j0j6.exe
3676	p9hzh98i.exe
4612	lj80cl62c4q.exe
5460	ProUpdate7dd338.exe
1244	pvxhtsr91.exe
6080	ProManagerc7e51.exe
4568	ProUpdate7dd338.exe
4528	ProManagerc7e51.exe
3424	AppManagerServicef7ad.exe
2408	15673f2e50a.exe
568	pvxhtsr91.exe
5604	n3a5bs1nyt8.exe
2364	AppManagerServicef7ad.exe
1460	s17fixd96kyi.exe
4796	utty6ivz0mp2.exe
3376	fmh4jv5s1wq.exe
3232	fwh0oesi71.exe
2728	ProUpdate7dd338.exe
1436	ProUpdate7dd338.exe

Modifies service settings 1 TTPs
Alters the configuration of existing services.
defense_evasion

Windows Service
T1543.003
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Windows\\Config\\700E238B\\NetHost1dcc90.exe"	z6wb0rbwhe7u.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3424 set thread context of 1212	3424	AppManagerServicef7ad.exe	179
PID 3232 set thread context of 3744	3232	fwh0oesi71.exe	193

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
352	sc.exe
5868	sc.exe
6008	sc.exe
2668	sc.exe
3960	sc.exe
720	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3644	cmd.exe
5720	cmd.exe
5196	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ProUpdate7dd338.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetHost1dcc90.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetHost1dcc90.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pvxhtsr91.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pvxhtsr91.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ProUpdate7dd338.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	SecurityHealthHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	SecurityHealthHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	SecurityHealthHost.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3248	schtasks.exe
4524	schtasks.exe
2000	schtasks.exe
4388	schtasks.exe
3532	schtasks.exe
4316	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5460	ProUpdate7dd338.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4116	powershell.exe
4116	powershell.exe
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe
3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
1260	powershell.exe
1260	powershell.exe
1260	powershell.exe
4660	powershell.exe
4660	powershell.exe
1012	powershell.exe
1012	powershell.exe
4660	powershell.exe
1012	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
2332	powershell.exe
2332	powershell.exe
2332	powershell.exe
3968	powershell.exe
2332	powershell.exe
2868	SecurityHealthHost.exe
2868	SecurityHealthHost.exe
476	SecurityHealthHost.exe
476	SecurityHealthHost.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
1568	powershell.exe
1568	powershell.exe
2512	powershell.exe
2512	powershell.exe
1568	powershell.exe
2512	powershell.exe
3900	powershell.exe
3900	powershell.exe
3900	powershell.exe
1300	powershell.exe
1300	powershell.exe
1300	powershell.exe
2872	powershell.exe
2872	powershell.exe
2872	powershell.exe
4520	powershell.exe
4520	powershell.exe
2860	powershell.exe
2860	powershell.exe
4520	powershell.exe
2860	powershell.exe
4484	powershell.exe
4484	powershell.exe
3700	powershell.exe
3700	powershell.exe
4484	powershell.exe
3700	powershell.exe
1172	z6wb0rbwhe7u.exe
1172	z6wb0rbwhe7u.exe
5596	NetHost1dcc90.exe
5596	NetHost1dcc90.exe
4516	z8svu6vd3.exe
4516	z8svu6vd3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1244	pvxhtsr91.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeSystemProfilePrivilege	2952	powershell.exe
Token: SeSystemtimePrivilege	2952	powershell.exe
Token: SeProfSingleProcessPrivilege	2952	powershell.exe
Token: SeIncBasePriorityPrivilege	2952	powershell.exe
Token: SeCreatePagefilePrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeRemoteShutdownPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 33	2952	powershell.exe
Token: 34	2952	powershell.exe
Token: 35	2952	powershell.exe
Token: 36	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeSystemProfilePrivilege	2952	powershell.exe
Token: SeSystemtimePrivilege	2952	powershell.exe
Token: SeProfSingleProcessPrivilege	2952	powershell.exe
Token: SeIncBasePriorityPrivilege	2952	powershell.exe
Token: SeCreatePagefilePrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe
Token: SeRestorePrivilege	2952	powershell.exe
Token: SeShutdownPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeSystemEnvironmentPrivilege	2952	powershell.exe
Token: SeRemoteShutdownPrivilege	2952	powershell.exe
Token: SeUndockPrivilege	2952	powershell.exe
Token: SeManageVolumePrivilege	2952	powershell.exe
Token: 33	2952	powershell.exe
Token: 34	2952	powershell.exe
Token: 35	2952	powershell.exe
Token: 36	2952	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	1012	powershell.exe
Token: SeIncreaseQuotaPrivilege	1260	powershell.exe
Token: SeSecurityPrivilege	1260	powershell.exe
Token: SeTakeOwnershipPrivilege	1260	powershell.exe
Token: SeLoadDriverPrivilege	1260	powershell.exe
Token: SeSystemProfilePrivilege	1260	powershell.exe
Token: SeSystemtimePrivilege	1260	powershell.exe
Token: SeProfSingleProcessPrivilege	1260	powershell.exe
Token: SeIncBasePriorityPrivilege	1260	powershell.exe
Token: SeCreatePagefilePrivilege	1260	powershell.exe
Token: SeBackupPrivilege	1260	powershell.exe
Token: SeRestorePrivilege	1260	powershell.exe
Token: SeShutdownPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeSystemEnvironmentPrivilege	1260	powershell.exe
Token: SeRemoteShutdownPrivilege	1260	powershell.exe
Token: SeUndockPrivilege	1260	powershell.exe
Token: SeManageVolumePrivilege	1260	powershell.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe
1244	pvxhtsr91.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4116	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	89
PID 3388 wrote to memory of 2952	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	91
PID 3388 wrote to memory of 3644	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	94
PID 3644 wrote to memory of 2212	3644	cmd.exe	96
PID 2212 wrote to memory of 6008	2212	net.exe	171
PID 3388 wrote to memory of 2000	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	98
PID 3388 wrote to memory of 476	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	102
PID 3388 wrote to memory of 1260	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	103
PID 2868 wrote to memory of 4660	2868	SecurityHealthHost.exe	105
PID 476 wrote to memory of 1012	476	SecurityHealthHost.exe	107
PID 2868 wrote to memory of 3968	2868	SecurityHealthHost.exe	109
PID 476 wrote to memory of 2332	476	SecurityHealthHost.exe	111
PID 3388 wrote to memory of 5108	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	114
PID 2868 wrote to memory of 5720	2868	SecurityHealthHost.exe	116
PID 5720 wrote to memory of 1272	5720	cmd.exe	118
PID 1272 wrote to memory of 5368	1272	net.exe	119
PID 476 wrote to memory of 5196	476	SecurityHealthHost.exe	120
PID 2868 wrote to memory of 4388	2868	SecurityHealthHost.exe	122
PID 5196 wrote to memory of 4488	5196	cmd.exe	124
PID 4488 wrote to memory of 4516	4488	net.exe	149
PID 476 wrote to memory of 3532	476	SecurityHealthHost.exe	126
PID 2868 wrote to memory of 1568	2868	SecurityHealthHost.exe	128
PID 476 wrote to memory of 2512	476	SecurityHealthHost.exe	130
PID 3388 wrote to memory of 3900	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	132
PID 476 wrote to memory of 1300	476	SecurityHealthHost.exe	134
PID 2868 wrote to memory of 2872	2868	SecurityHealthHost.exe	136
PID 3388 wrote to memory of 4520	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	138
PID 476 wrote to memory of 2860	476	SecurityHealthHost.exe	140
PID 2868 wrote to memory of 4484	2868	SecurityHealthHost.exe	142
PID 476 wrote to memory of 3700	476	SecurityHealthHost.exe	144
PID 3388 wrote to memory of 1172	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	146
PID 1172 wrote to memory of 5596	1172	z6wb0rbwhe7u.exe	147
PID 3388 wrote to memory of 4516	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	149
PID 3388 wrote to memory of 6060	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	150
PID 476 wrote to memory of 3676	476	SecurityHealthHost.exe	151
PID 2868 wrote to memory of 5540	2868	SecurityHealthHost.exe	152
PID 6060 wrote to memory of 4316	6060	wehyjz07j0j6.exe	153
PID 3388 wrote to memory of 4612	3388	2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	156
PID 4516 wrote to memory of 3248	4516	z8svu6vd3.exe	157
PID 6060 wrote to memory of 5460	6060	wehyjz07j0j6.exe	159
PID 4612 wrote to memory of 352	4612	lj80cl62c4q.exe	160
PID 476 wrote to memory of 1244	476	SecurityHealthHost.exe	163
PID 5460 wrote to memory of 5436	5460	ProUpdate7dd338.exe	164
PID 4612 wrote to memory of 5868	4612	lj80cl62c4q.exe	167
PID 4516 wrote to memory of 6080	4516	z8svu6vd3.exe	169
PID 4612 wrote to memory of 6008	4612	lj80cl62c4q.exe	171
PID 1244 wrote to memory of 4524	1244	pvxhtsr91.exe	175
PID 476 wrote to memory of 2408	476	SecurityHealthHost.exe	177
PID 3424 wrote to memory of 1212	3424	AppManagerServicef7ad.exe	179
PID 476 wrote to memory of 5604	476	SecurityHealthHost.exe	181
PID 5604 wrote to memory of 720	5604	n3a5bs1nyt8.exe	182
PID 5604 wrote to memory of 3960	5604	n3a5bs1nyt8.exe	184
PID 5604 wrote to memory of 2668	5604	n3a5bs1nyt8.exe	186
PID 2868 wrote to memory of 1460	2868	SecurityHealthHost.exe	189
PID 2868 wrote to memory of 4796	2868	SecurityHealthHost.exe	190
PID 2868 wrote to memory of 3376	2868	SecurityHealthHost.exe	191
PID 2868 wrote to memory of 3232	2868	SecurityHealthHost.exe	192
PID 3232 wrote to memory of 3744	3232	fwh0oesi71.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1416
- C:\Users\Admin\AppData\Local\Temp\2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-25_ca510354d234468e673fa934a24a06b5_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"
  2⤵
  - Downloads MZ/PE file
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Milliseconds 2500"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$g=@((Get-CimInstance Win32_VideoController -EA SilentlyContinue|Select-Object -ExpandProperty Name));$d=[int64]((Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -EA SilentlyContinue).Size);$pr=@(Get-Process -EA SilentlyContinue);$w=[bool]($pr|Where-Object {$_.ProcessName -eq 'CExecSvc'});@{g=($g -join '|');d=$d;p=$pr.Count;w=$w;n=(($pr|Select-Object -ExpandProperty ProcessName)-join '|')}|ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2212
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6008
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn SecurityHealthHost /tr C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe /sc onlogon /rl limited /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2000
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Milliseconds 2500"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$g=@((Get-CimInstance Win32_VideoController -EA SilentlyContinue|Select-Object -ExpandProperty Name));$d=[int64]((Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -EA SilentlyContinue).Size);$pr=@(Get-Process -EA SilentlyContinue);$w=[bool]($pr|Where-Object {$_.ProcessName -eq 'CExecSvc'});@{g=($g -join '|');d=$d;p=$pr.Count;w=$w;n=(($pr|Select-Object -ExpandProperty ProcessName)-join '|')}|ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:2332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "net session"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5196
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4488
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:4516
  - - C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn SecurityHealthHost /tr C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe /sc onlogon /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"p9hzh98i.exe\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:2512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"pvxhtsr91.exe\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:1300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"15673f2e50a.exe\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:2860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"n3a5bs1nyt8.exe\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\p9hzh98i.exe
      C:\Users\Admin\AppData\Local\Temp\p9hzh98i.exe
      4⤵
      Executes dropped EXE
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\pvxhtsr91.exe
      C:\Users\Admin\AppData\Local\Temp\pvxhtsr91.exe
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1244
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /tn "UpdateHost_1117" /tr "C:\Users\Admin\AppData\Local\Temp\pvxhtsr91.exe" /sc minute /mo 1 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\15673f2e50a.exe
      C:\Users\Admin\AppData\Local\Temp\15673f2e50a.exe
      4⤵
      Executes dropped EXE
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\n3a5bs1nyt8.exe
      C:\Users\Admin\AppData\Local\Temp\n3a5bs1nyt8.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5604
    - - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" delete "CheckManager_29ce"
        5⤵
        Launches sc.exe
        
        PID:720
    - - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" create "CheckManager_29ce" binpath= "C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:3960
    - - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" start "CheckManager_29ce"
        5⤵
        Launches sc.exe
        
        PID:2668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"z6wb0rbwhe7u.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"z8svu6vd3.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:5108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"wehyjz07j0j6.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:3900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"lj80cl62c4q.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\z6wb0rbwhe7u.exe
    C:\Users\Admin\AppData\Local\Temp\z6wb0rbwhe7u.exe
    3⤵
    - Executes dropped EXE
    - Registers new Windows logon scripts automatically executed at logon.
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Users\Admin\AppData\Local\Windows\Config\700E238B\NetHost1dcc90.exe
      "C:\Users\Admin\AppData\Local\Windows\Config\700E238B\NetHost1dcc90.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5596
- - C:\Users\Admin\AppData\Local\Temp\z8svu6vd3.exe
    C:\Users\Admin\AppData\Local\Temp\z8svu6vd3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "UpdateHost_1117" /tr "C:\Users\Admin\AppData\Roaming\LogsF308\ProManagerc7e51.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3248
  - - C:\Users\Admin\AppData\Roaming\LogsF308\ProManagerc7e51.exe
      "C:\Users\Admin\AppData\Roaming\LogsF308\ProManagerc7e51.exe"
      4⤵
      Executes dropped EXE
      PID:6080
- - C:\Users\Admin\AppData\Local\Temp\wehyjz07j0j6.exe
    C:\Users\Admin\AppData\Local\Temp\wehyjz07j0j6.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "MaintainHost_058f" /tr "C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4316
  - - C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
      "C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of WriteProcessMemory
      PID:5460
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "MaintainHost_058f"
        5⤵
        
        PID:5436
- - C:\Users\Admin\AppData\Local\Temp\lj80cl62c4q.exe
    C:\Users\Admin\AppData\Local\Temp\lj80cl62c4q.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" delete "CheckManager_29ce"
      4⤵
      Launches sc.exe
      PID:352
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" create "CheckManager_29ce" binpath= "C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:5868
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start "CheckManager_29ce"
      4⤵
      Launches sc.exe
      PID:6008
- C:\Windows\System32\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  PID:1212
- C:\Windows\System32\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  PID:3744

C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Milliseconds 2500"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$g=@((Get-CimInstance Win32_VideoController -EA SilentlyContinue|Select-Object -ExpandProperty Name));$d=[int64]((Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -EA SilentlyContinue).Size);$pr=@(Get-Process -EA SilentlyContinue);$w=[bool]($pr|Where-Object {$_.ProcessName -eq 'CExecSvc'});@{g=($g -join '|');d=$d;p=$pr.Count;w=$w;n=(($pr|Select-Object -ExpandProperty ProcessName)-join '|')}|ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5368
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn SecurityHealthHost /tr C:\Users\Admin\AppData\Local\Microsoft\Windows\SecurityHealthHost.exe /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"s17fixd96kyi.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"utty6ivz0mp2.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"fmh4jv5s1wq.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"fwh0oesi71.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  PID:5540
- C:\Users\Admin\AppData\Local\Temp\s17fixd96kyi.exe
  C:\Users\Admin\AppData\Local\Temp\s17fixd96kyi.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\utty6ivz0mp2.exe
  C:\Users\Admin\AppData\Local\Temp\utty6ivz0mp2.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Users\Admin\AppData\Local\Temp\fmh4jv5s1wq.exe
  C:\Users\Admin\AppData\Local\Temp\fmh4jv5s1wq.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Users\Admin\AppData\Local\Temp\fwh0oesi71.exe
  C:\Users\Admin\AppData\Local\Temp\fwh0oesi71.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3232

C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Users\Admin\AppData\Roaming\LogsF308\ProManagerc7e51.exe
C:\Users\Admin\AppData\Roaming\LogsF308\ProManagerc7e51.exe
1⤵
- Executes dropped EXE
PID:4528

C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe
C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3424

C:\Users\Admin\AppData\Local\Temp\pvxhtsr91.exe
C:\Users\Admin\AppData\Local\Temp\pvxhtsr91.exe
1⤵
- Executes dropped EXE
PID:568

C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe
C:\ProgramData\Windows\Config\57AE748E\AppManagerServicef7ad.exe
1⤵
- Executes dropped EXE
PID:2364

C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
"C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe"
1⤵
- Executes dropped EXE
PID:2728

C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe
"C:\Users\Admin\AppData\Local\Common\Common\Temp\E8204C9F\ProUpdate7dd338.exe"
1⤵
- Executes dropped EXE
PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Impair Defenses

T1562

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489