50bb2f7a4178a0d9a7e31e9e37769dfddaf135319af3c9a5f117ee2490160e0d

Analysis

max time kernel
110s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe
Size 499KB
Sample261002-1gb1katdph
SHA256 50bb2f7a4178a0d9a7e31e9e37769dfddaf135319af3c9a5f117ee2490160e0d
MD5 fd86c0cb3ac465093e1d0a9685b3afe6
SHA1 ac12b06673c910bd9ab34bfefdc3c91544e49793
SHA512 ab4dabe3b56585428cf47f1a81fe9d7a315bbc48664a50e404e835ace3c76c24a20af738bce466dfc8e545bad414aa60db26ce90dad1d8d65a05fc16479d1a7f
SSDEEP 6144:5/fyglvIj120hejA2VXHr/I/5bTgVziHzZnSKrCbYME+Sb68Rq:539lvIjRhDE/I/5/gVziHlBrCbY+84
TLSH
T1F3B44B26B1954961C1951732CCD75301A3F2E06B62A3E79F7A8127E93E033F2DE067A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4612 created 5540	4612	WerFault.exe	92

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2956 created 5540	2956	svchost.exe	92

Detects executables packed with unregistered version of .NET Reactor 5 IoCs

resource	yara_rule
behavioral2/memory/1260-1-0x000001A175DC0000-0x000001A175E42000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/memory/4844-307-0x0000022F12400000-0x0000022F12482000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/memory/1260-358-0x000001A178750000-0x000001A1787A2000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/files/0x000d00000001c555-494.dat	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/memory/5392-513-0x0000024C356A0000-0x0000024C35722000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1512	netsh.exe

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/1260-358-0x000001A178750000-0x000001A1787A2000-memory.dmp	net_reactor
behavioral2/files/0x000d00000001c555-494.dat	net_reactor

Executes dropped EXE 4 IoCs

pid	Process
1152	snej1wxo.rm1.exe
4544	t2bck24c.5s0.exe
5392	Trojan.exe
984	cxopukyr.ept.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\MasonTrojan.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies data under HKEY_USERS 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 02 Oct 2026 20:57:04 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1790977035"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={9A3EAF8A-2B22-4D51-9C49-3601EFEBF800}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3724	SCHTASKS.exe
5540	SCHTASKS.exe
2592	SCHTASKS.exe
2172	SCHTASKS.exe
3036	SCHTASKS.exe
924	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
1152	snej1wxo.rm1.exe
1152	snej1wxo.rm1.exe
4716	WerFault.exe
4716	WerFault.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
4544	t2bck24c.5s0.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe
984	cxopukyr.ept.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4464	explorer.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1152	snej1wxo.rm1.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeDebugPrivilege	4844	2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4544	t2bck24c.5s0.exe
Token: SeDebugPrivilege	5392	Trojan.exe
Token: SeDebugPrivilege	984	cxopukyr.ept.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe
Token: SeShutdownPrivilege	4464	explorer.exe
Token: SeCreatePagefilePrivilege	4464	explorer.exe

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
4464	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1152	1260	2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe	89
PID 1260 wrote to memory of 3724	1260	2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe	90
PID 1152 wrote to memory of 748	1152	snej1wxo.rm1.exe	5
PID 1152 wrote to memory of 960	1152	snej1wxo.rm1.exe	9
PID 1152 wrote to memory of 968	1152	snej1wxo.rm1.exe	10
PID 1152 wrote to memory of 360	1152	snej1wxo.rm1.exe	11
PID 1152 wrote to memory of 596	1152	snej1wxo.rm1.exe	13
PID 1152 wrote to memory of 1144	1152	snej1wxo.rm1.exe	14
PID 1152 wrote to memory of 1188	1152	snej1wxo.rm1.exe	15
PID 1152 wrote to memory of 1208	1152	snej1wxo.rm1.exe	16
PID 1152 wrote to memory of 1308	1152	snej1wxo.rm1.exe	17
PID 1152 wrote to memory of 1332	1152	snej1wxo.rm1.exe	18
PID 1152 wrote to memory of 1452	1152	snej1wxo.rm1.exe	20
PID 1152 wrote to memory of 1520	1152	snej1wxo.rm1.exe	21
PID 1152 wrote to memory of 1532	1152	snej1wxo.rm1.exe	22
PID 1152 wrote to memory of 1540	1152	snej1wxo.rm1.exe	23
PID 1152 wrote to memory of 1548	1152	snej1wxo.rm1.exe	24
PID 1152 wrote to memory of 1776	1152	snej1wxo.rm1.exe	25
PID 1152 wrote to memory of 1784	1152	snej1wxo.rm1.exe	26
PID 1152 wrote to memory of 1844	1152	snej1wxo.rm1.exe	27
PID 1152 wrote to memory of 1928	1152	snej1wxo.rm1.exe	28
PID 1152 wrote to memory of 2016	1152	snej1wxo.rm1.exe	29
PID 1152 wrote to memory of 564	1152	snej1wxo.rm1.exe	30
PID 1152 wrote to memory of 2188	1152	snej1wxo.rm1.exe	32
PID 1152 wrote to memory of 2204	1152	snej1wxo.rm1.exe	33
PID 1152 wrote to memory of 2236	1152	snej1wxo.rm1.exe	34
PID 1152 wrote to memory of 2356	1152	snej1wxo.rm1.exe	35
PID 1152 wrote to memory of 2364	1152	snej1wxo.rm1.exe	36
PID 1152 wrote to memory of 2440	1152	snej1wxo.rm1.exe	37
PID 1152 wrote to memory of 2584	1152	snej1wxo.rm1.exe	38
PID 1152 wrote to memory of 2604	1152	snej1wxo.rm1.exe	39
PID 1152 wrote to memory of 2740	1152	snej1wxo.rm1.exe	40
PID 1152 wrote to memory of 2772	1152	snej1wxo.rm1.exe	41
PID 1152 wrote to memory of 2840	1152	snej1wxo.rm1.exe	42
PID 1152 wrote to memory of 2924	1152	snej1wxo.rm1.exe	43
PID 1152 wrote to memory of 2272	1152	snej1wxo.rm1.exe	44
PID 1152 wrote to memory of 3076	1152	snej1wxo.rm1.exe	45
PID 1152 wrote to memory of 3180	1152	snej1wxo.rm1.exe	47
PID 1152 wrote to memory of 3188	1152	snej1wxo.rm1.exe	48
PID 1152 wrote to memory of 3492	1152	snej1wxo.rm1.exe	50
PID 1152 wrote to memory of 3520	1152	snej1wxo.rm1.exe	51
PID 1152 wrote to memory of 3528	1152	snej1wxo.rm1.exe	52
PID 1152 wrote to memory of 3548	1152	snej1wxo.rm1.exe	53
PID 1152 wrote to memory of 3608	1152	snej1wxo.rm1.exe	54
PID 1152 wrote to memory of 3620	1152	snej1wxo.rm1.exe	55
PID 1152 wrote to memory of 3656	1152	snej1wxo.rm1.exe	56
PID 1152 wrote to memory of 3264	1152	snej1wxo.rm1.exe	57
PID 1152 wrote to memory of 1156	1152	snej1wxo.rm1.exe	58
PID 1152 wrote to memory of 4368	1152	snej1wxo.rm1.exe	59
PID 1152 wrote to memory of 4424	1152	snej1wxo.rm1.exe	60
PID 1152 wrote to memory of 4488	1152	snej1wxo.rm1.exe	61
PID 1152 wrote to memory of 4568	1152	snej1wxo.rm1.exe	62
PID 1152 wrote to memory of 4928	1152	snej1wxo.rm1.exe	63
PID 1152 wrote to memory of 4976	1152	snej1wxo.rm1.exe	64
PID 1152 wrote to memory of 5164	1152	snej1wxo.rm1.exe	65
PID 1152 wrote to memory of 5228	1152	snej1wxo.rm1.exe	66
PID 1152 wrote to memory of 5272	1152	snej1wxo.rm1.exe	67
PID 1152 wrote to memory of 5632	1152	snej1wxo.rm1.exe	70
PID 1152 wrote to memory of 4252	1152	snej1wxo.rm1.exe	73
PID 1152 wrote to memory of 3212	1152	snej1wxo.rm1.exe	74
PID 1152 wrote to memory of 4900	1152	snej1wxo.rm1.exe	75
PID 1152 wrote to memory of 2160	1152	snej1wxo.rm1.exe	78
PID 1152 wrote to memory of 4376	1152	snej1wxo.rm1.exe	79
PID 1152 wrote to memory of 2180	1152	snej1wxo.rm1.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:748
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:960
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1144

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:968

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-43258e91-2ab4-4e51-9bf5-b950b9113556 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2ee7a392-1bb0-4df6-ab70-8189bbace270 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-acba255c-a870-4a80-8104-3069f6aa548f -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-795d954d-764f-4eae-bea6-833b6f0262e3 -LifetimeId:f94c3a33-3d40-4194-949c-2d3a16c8a08e -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1928
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2180
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\snej1wxo.rm1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\snej1wxo.rm1.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1152
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3724
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5540
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4784
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5540 -s 104
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Trojan.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\cxopukyr.ept.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cxopukyr.ept.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:984
      - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "MasonTrojan.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Trojan.exe'" /sc onlogon /rl HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3036
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1092
      - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "MasonTrojan.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Trojan.exe'" /sc onlogon /rl HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:924
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4316
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1512
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2440
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000238;0000000000000244;
  2⤵
  PID:4976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2924

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3188

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
- Modifies data under HKEY_USERS
PID:3528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1156

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4928

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5164

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5228

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2160

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:3196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:2956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 492 -p 5540 -ip 5540
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:4612

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4392

C:\Users\Admin\AppData\Local\Temp\2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844
- C:\Users\Admin\AppData\Local\Temp\t2bck24c.5s0.exe
  "C:\Users\Admin\AppData\Local\Temp\t2bck24c.5s0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2592
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3644
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-10-02_fd86c0cb3ac465093e1d0a9685b3afe6_cobalt-strike_dcrat_elex_glassworm_icedid_njrat_vidar.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5932

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Process Injection

T1055

Process Hollowing

T1055.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER.5f9dd5a8-9cdd-4abf-bb8b-3a84e16d746d.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.5f9dd5a8-9cdd-4abf-bb8b-3a84e16d746d.tmp.txt
Size 13KB
SHA256 30412cd2e4e104eac1326c34e882b4eeb91b22394b8aaacf949f125ce6264d53
MD5 ec1754d0ce31f3f2dcfe242f837f0877
SHA1 96167c114b962d1e8b45482809dbb210e75cc131
SHA512 539c87e16c7dfd830ca3af7a50c90f4e7babf2d548bd656de4a0d4cd8efe8efc83d644a757f35d631c885347f384c5b26fffbfadfd3b0b60aea5009f6e8bdb2c
SSDEEP 96:4iefBQGbXoo/AWYxYcWiBMqH7YEZC6tCiBFM3aw4SfPa0A2MeZaI5K3:NefBQIbG0JaMPa0A2MeZN5K3
TLSH
T1DF527F5616E80349F2F75E88A5F020A55773F872AE39C64D01DE130E87E3E41E866FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.d204d6f8-a319-488e-bb99-d33ab59d7c25.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.d204d6f8-a319-488e-bb99-d33ab59d7c25.tmp.csv
Size 40KB
SHA256 deb823dcfcf31839a94f10e53815a1d9fbfa67e30dfdf84af51b03363234d3c8
MD5 77e70887e10d867ec27e9c2f63e0cf61
SHA1 ae55b1a76340636cc8dc1cf85acd92c7300aebb2
SHA512 6ecb49a88a1c4e1dc01c1c4c6437bfdd2b1f46b0a31104ab1f610e7acc88ef1567c0afe48f59be74d606af7230c082c7bf2df3664f2509d6355194c5a14bcdd5
SSDEEP 768:T60+m81I/R+xg+JhjUy3oUGfiBOrzhYLyvoJoj4DU8Z2II5za:T6w8fxln3oUGfiBOHeLyvo2UDtI3k
TLSH
T11D03143DCEE9023FC2B6DA1CC8E64607F895A453361EED4D94D3678A4567983BCD022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trojan.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Size 499KB
SHA256 50bb2f7a4178a0d9a7e31e9e37769dfddaf135319af3c9a5f117ee2490160e0d
MD5 fd86c0cb3ac465093e1d0a9685b3afe6
SHA1 ac12b06673c910bd9ab34bfefdc3c91544e49793
SHA512 ab4dabe3b56585428cf47f1a81fe9d7a315bbc48664a50e404e835ace3c76c24a20af738bce466dfc8e545bad414aa60db26ce90dad1d8d65a05fc16479d1a7f
SSDEEP 6144:5/fyglvIj120hejA2VXHr/I/5bTgVziHzZnSKrCbYME+Sb68Rq:539lvIjRhDE/I/5/gVziHlBrCbY+84
TLSH
T1F3B44B26B1954961C1951732CCD75301A3F2E06B62A3E79F7A8127E93E033F2DE067A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snej1wxo.rm1.exe

Path C:\Users\Admin\AppData\Local\Temp\snej1wxo.rm1.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonTrojan.exe

Path C:\Windows\System32\Tasks\MasonTrojan.exe
Size 3KB
SHA256 5559cafb3beaaa58c87fa0332184e637e6e2fdc36108dfbff5197242f9cccec4
MD5 ecc8d905555edd6efc578e91b97642d0
SHA1 e816b5e51969e0e3b5744c7270e7fd71f22670aa
SHA512 517c0c72269b7d5742c40b10fb43478ed3f96b2809922911023ec2df92f160857df2a1d34f5d4d8040af1e52d814f068dce025849116ce1bade224a41458b13d
TLSH
T1FC61875767FE1109F2F7AB2CAEB750228A63BC555939C42D00AC240DCBF3E2285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 7147f6c74574b88e478fcf68b0f15b463beddc056b7d255249a89416d842642c
MD5 86aef4488303bbf87cdeefb650b51510
SHA1 569e0038503081c9851c55d6d337e39d8f061b51
SHA512 5c006050365b6e71bba0d8cb49255eaf04aec737d247c31e3ff134a117e5b140099c1ef4c30c34ef1181fe53f7305211b18a69f234775866fc61797ea9700c18
TLSH
T123E086512AA81214E5330E3DA9736445D93AB3265E02C6DD47B4108D0C24FA18A32B1D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 1fe8097515cb8693c0c806fb53f847368d489229d13e59c28618f7bc0b1804f0
MD5 cd4f7afa2aa20d9f0ede303b4c78b03f
SHA1 72b749e30f9f698757bd20caee11931408bb67c5
SHA512 387b506c79d2f4fb18b294d6c4f2914d96012670baa93e0455ea05bd674827307e3f548d6baa8a78eedee5a6300ef9a6c3f5224c2404004ed7ddd63642d11504
TLSH
T12BE0C01412FF912CF4F4C0348BE5AA3245DEF0630418B2BA1ED01B006716900EC42938
MD5 SHA1 SHA512 TLSH

Submit Download

memory/360-753-0x0000029E31160000-0x0000029E3118B000-memory.dmp

Download

memory/360-300-0x0000029E31160000-0x0000029E3118B000-memory.dmp

Download

memory/360-68-0x0000029E31160000-0x0000029E3118B000-memory.dmp

Download

memory/360-70-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/564-147-0x000002251BFA0000-0x000002251BFCB000-memory.dmp

Download

memory/564-148-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/596-79-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/596-301-0x000002B059C40000-0x000002B059C6B000-memory.dmp

Download

memory/596-754-0x000002B059C40000-0x000002B059C6B000-memory.dmp

Download

memory/596-76-0x000002B059C40000-0x000002B059C6B000-memory.dmp

Download

memory/748-295-0x000001B587410000-0x000001B58743B000-memory.dmp

Download

memory/748-15-0x000001B5873E0000-0x000001B587405000-memory.dmp

Download

memory/748-748-0x000001B587410000-0x000001B58743B000-memory.dmp

Download

memory/748-16-0x000001B587410000-0x000001B58743B000-memory.dmp

Download

memory/748-17-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/960-749-0x000002C287940000-0x000002C28796B000-memory.dmp

Download

memory/960-23-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/960-22-0x000002C287940000-0x000002C28796B000-memory.dmp

Download

memory/960-296-0x000002C287940000-0x000002C28796B000-memory.dmp

Download

memory/968-25-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/968-750-0x0000026BAF530000-0x0000026BAF55B000-memory.dmp

Download

memory/968-21-0x0000026BAF530000-0x0000026BAF55B000-memory.dmp

Download

memory/968-297-0x0000026BAF530000-0x0000026BAF55B000-memory.dmp

Download

memory/1144-298-0x000002E28ADD0000-0x000002E28ADFB000-memory.dmp

Download

memory/1144-31-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1144-30-0x000002E28ADD0000-0x000002E28ADFB000-memory.dmp

Download

memory/1144-751-0x000002E28ADD0000-0x000002E28ADFB000-memory.dmp

Download

memory/1152-13-0x00007FFA53D70000-0x00007FFA53E37000-memory.dmp

Download

memory/1152-12-0x00007FFA54400000-0x00007FFA54663000-memory.dmp

Download

memory/1188-755-0x0000028A97E80000-0x0000028A97EAB000-memory.dmp

Download

memory/1188-302-0x0000028A97E80000-0x0000028A97EAB000-memory.dmp

Download

memory/1188-83-0x0000028A97E80000-0x0000028A97EAB000-memory.dmp

Download

memory/1188-84-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1208-303-0x0000015767860000-0x000001576788B000-memory.dmp

Download

memory/1208-87-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1208-756-0x0000015767860000-0x000001576788B000-memory.dmp

Download

memory/1208-86-0x0000015767860000-0x000001576788B000-memory.dmp

Download

memory/1260-432-0x000001A1787E0000-0x000001A1787F0000-memory.dmp

Download

memory/1260-5-0x00007FFA31870000-0x00007FFA32214000-memory.dmp

Download

memory/1260-0-0x00007FFA319FF000-0x00007FFA31A00000-memory.dmp

Download

memory/1260-358-0x000001A178750000-0x000001A1787A2000-memory.dmp

Download

memory/1260-501-0x00007FFA31870000-0x00007FFA32214000-memory.dmp

Download

memory/1260-293-0x00007FFA31870000-0x00007FFA32214000-memory.dmp

Download

memory/1260-2-0x000001A1762A0000-0x000001A1762CC000-memory.dmp

Download

memory/1260-278-0x00007FFA31870000-0x00007FFA32214000-memory.dmp

Download

memory/1260-1-0x000001A175DC0000-0x000001A175E42000-memory.dmp

Download

memory/1260-290-0x00007FFA31870000-0x00007FFA32214000-memory.dmp

Download

memory/1260-14-0x00007FFA31870000-0x00007FFA32214000-memory.dmp

Download

memory/1308-757-0x000002DFECE10000-0x000002DFECE3B000-memory.dmp

Download

memory/1308-308-0x000002DFECE10000-0x000002DFECE3B000-memory.dmp

Download

memory/1308-89-0x000002DFECE10000-0x000002DFECE3B000-memory.dmp

Download

memory/1308-90-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1332-758-0x000001D76F450000-0x000001D76F47B000-memory.dmp

Download

memory/1332-309-0x000001D76F450000-0x000001D76F47B000-memory.dmp

Download

memory/1332-93-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1332-92-0x000001D76F450000-0x000001D76F47B000-memory.dmp

Download

memory/1452-101-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1452-759-0x00000200B65E0000-0x00000200B660B000-memory.dmp

Download

memory/1452-310-0x00000200B65E0000-0x00000200B660B000-memory.dmp

Download

memory/1452-99-0x00000200B65E0000-0x00000200B660B000-memory.dmp

Download

memory/1520-116-0x000001BE3DB90000-0x000001BE3DBBB000-memory.dmp

Download

memory/1520-118-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1532-40-0x000001BA12540000-0x000001BA1256B000-memory.dmp

Download

memory/1532-41-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1532-299-0x000001BA12540000-0x000001BA1256B000-memory.dmp

Download

memory/1532-752-0x000001BA12540000-0x000001BA1256B000-memory.dmp

Download

memory/1540-130-0x000001CE4BA20000-0x000001CE4BA4B000-memory.dmp

Download

memory/1540-132-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1548-127-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1548-126-0x000002AED8EC0000-0x000002AED8EEB000-memory.dmp

Download

memory/1776-131-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1776-129-0x000001B995B80000-0x000001B995BAB000-memory.dmp

Download

memory/1784-136-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1784-135-0x0000027AC9FE0000-0x0000027ACA00B000-memory.dmp

Download

memory/1844-139-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1844-138-0x000001DC00030000-0x000001DC0005B000-memory.dmp

Download

memory/1928-142-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/1928-141-0x0000013E25D10000-0x0000013E25D3B000-memory.dmp

Download

memory/2016-144-0x0000024DBF510000-0x0000024DBF53B000-memory.dmp

Download

memory/2016-145-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/2188-153-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/2188-150-0x000002063C7D0000-0x000002063C7FB000-memory.dmp

Download

memory/2204-152-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/2204-151-0x000002DBCF5D0000-0x000002DBCF5FB000-memory.dmp

Download

memory/2236-155-0x0000020841C50000-0x0000020841C7B000-memory.dmp

Download

memory/2236-156-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/2356-158-0x0000014ECBB50000-0x0000014ECBB7B000-memory.dmp

Download

memory/2356-159-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/2364-161-0x000002E79E610000-0x000002E79E63B000-memory.dmp

Download

memory/2364-162-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/2584-164-0x0000024393E40000-0x0000024393E6B000-memory.dmp

Download

memory/2604-165-0x000001892EFD0000-0x000001892EFFB000-memory.dmp

Download

memory/2604-166-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/2740-169-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/2740-168-0x000001EC76BD0000-0x000001EC76BFB000-memory.dmp

Download

memory/4464-123-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/4464-121-0x0000000003720000-0x000000000374B000-memory.dmp

Download

memory/4844-307-0x0000022F12400000-0x0000022F12482000-memory.dmp

Download

memory/4976-760-0x000001D60D720000-0x000001D60D74B000-memory.dmp

Download

memory/4976-106-0x00007FFA14540000-0x00007FFA14550000-memory.dmp

Download

memory/4976-311-0x000001D60D720000-0x000001D60D74B000-memory.dmp

Download

memory/4976-104-0x000001D60D720000-0x000001D60D74B000-memory.dmp

Download

memory/5392-513-0x0000024C356A0000-0x0000024C35722000-memory.dmp

Download