7977ddd4987e4cd57aa0d12f712a55b28a0b572454883c99c0e07f9692cfaea9

Analysis

max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Size 38.9MB
Sample261027-efngbaat4w
SHA256 7977ddd4987e4cd57aa0d12f712a55b28a0b572454883c99c0e07f9692cfaea9
MD5 e79cafb13ed051b1b2111ad097c3ac12
SHA1 66863629ae784f727293d7f8416371ff2b2540f4
SHA512 c784d3dad420383c410cacdfdd54c0dabf4ae46ebee74b7e6dbe11d6059e7ef576e4e1992613e3f1715f1d5df36d8075bf5ca29d1a11fee5ac0a6e9e94f6606f
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsX2:q6chqTShW/hNbSiQfMJPLmrUls2
TLSH
T11097D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Z1h8w3 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Detects executables containing artifacts associated with disabling Widnows Defender 3 IoCs

resource	yara_rule
behavioral2/memory/5140-682-0x0000000003910000-0x00000000040ED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5140-686-0x0000000003910000-0x00000000040ED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5140-707-0x0000000003910000-0x00000000040ED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5944	Y5a34c.exe
3412	Y5a34c.exe

Loads dropped DLL 2 IoCs

pid	Process
5944	Y5a34c.exe
3412	Y5a34c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Z1h8w3\\Y5a34c.exe\""	Y5a34c.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
760	cmd.exe
5244	cmd.exe
4152	cmd.exe
2420	cmd.exe
616	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Y5a34c.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\eQHpWW\eQHpWW.exe	Y5a34c.exe
File created	C:\Program Files (x86)\eQHpWW\XPSPLOG.dll	Y5a34c.exe
File created	C:\Program Files (x86)\eQHpWW\image.png	Y5a34c.exe
File opened for modification	C:\Program Files (x86)\eQHpWW\XPSPLOG.dll	Y5a34c.exe
File opened for modification	C:\Program Files (x86)\eQHpWW	Y5a34c.exe
File created	C:\Program Files (x86)\eQHpWW\thumbs.db	Y5a34c.exe
File opened for modification	C:\Program Files (x86)\eQHpWW\eQHpWW.exe	Y5a34c.exe
File opened for modification	C:\Program Files (x86)\eQHpWW\image.png	Y5a34c.exe
File opened for modification	C:\Program Files (x86)\eQHpWW\thumbs.db	Y5a34c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5608	cmd.exe
1380	cmd.exe
1472	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Y5a34c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Y5a34c.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3832	schtasks.exe
5660	schtasks.exe
5732	schtasks.exe
1836	schtasks.exe
5232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4940	2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe
5944	Y5a34c.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeIncreaseQuotaPrivilege	2368	powershell.exe
Token: SeSecurityPrivilege	2368	powershell.exe
Token: SeTakeOwnershipPrivilege	2368	powershell.exe
Token: SeLoadDriverPrivilege	2368	powershell.exe
Token: SeSystemProfilePrivilege	2368	powershell.exe
Token: SeSystemtimePrivilege	2368	powershell.exe
Token: SeProfSingleProcessPrivilege	2368	powershell.exe
Token: SeIncBasePriorityPrivilege	2368	powershell.exe
Token: SeCreatePagefilePrivilege	2368	powershell.exe
Token: SeBackupPrivilege	2368	powershell.exe
Token: SeRestorePrivilege	2368	powershell.exe
Token: SeShutdownPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeSystemEnvironmentPrivilege	2368	powershell.exe
Token: SeRemoteShutdownPrivilege	2368	powershell.exe
Token: SeUndockPrivilege	2368	powershell.exe
Token: SeManageVolumePrivilege	2368	powershell.exe
Token: 33	2368	powershell.exe
Token: 34	2368	powershell.exe
Token: 35	2368	powershell.exe
Token: 36	2368	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 2368	5944	Y5a34c.exe	91
PID 5944 wrote to memory of 616	5944	Y5a34c.exe	93
PID 616 wrote to memory of 3832	616	cmd.exe	95
PID 616 wrote to memory of 5160	616	cmd.exe	96
PID 5944 wrote to memory of 760	5944	Y5a34c.exe	100
PID 616 wrote to memory of 4764	616	cmd.exe	101
PID 760 wrote to memory of 5660	760	cmd.exe	105
PID 5944 wrote to memory of 5244	5944	Y5a34c.exe	106
PID 760 wrote to memory of 3820	760	cmd.exe	108
PID 5944 wrote to memory of 4152	5944	Y5a34c.exe	110
PID 5244 wrote to memory of 5732	5244	cmd.exe	111
PID 760 wrote to memory of 1648	760	cmd.exe	113
PID 5944 wrote to memory of 2420	5944	Y5a34c.exe	116
PID 5244 wrote to memory of 5432	5244	cmd.exe	118
PID 4152 wrote to memory of 1836	4152	cmd.exe	119
PID 2420 wrote to memory of 5232	2420	cmd.exe	120
PID 4152 wrote to memory of 4892	4152	cmd.exe	121
PID 5244 wrote to memory of 4928	5244	cmd.exe	122
PID 2420 wrote to memory of 4888	2420	cmd.exe	124
PID 4152 wrote to memory of 2684	4152	cmd.exe	125
PID 2420 wrote to memory of 2192	2420	cmd.exe	126
PID 5608 wrote to memory of 5624	5608	cmd.exe	129
PID 1380 wrote to memory of 2820	1380	cmd.exe	130
PID 1472 wrote to memory of 1788	1472	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e79cafb13ed051b1b2111ad097c3ac12_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4940

C:\Users\Public\Z1h8w3\Y5a34c.exe
"C:\Users\Public\Z1h8w3\Y5a34c.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Z1h8w3\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Z1h8w3\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3832
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5432
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4892
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5232
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4888
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2192
- C:\Program Files (x86)\eQHpWW\eQHpWW.exe
  "C:\Program Files (x86)\eQHpWW\eQHpWW.exe"
  2⤵
  PID:5140

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Z1h8w3" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Z1h8w3" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5624

C:\Users\Public\Z1h8w3\Y5a34c.exe
"C:\Users\Public\Z1h8w3\Y5a34c.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3412

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4360

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2820

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1788

C:\Program Files (x86)\eQHpWW\eQHpWW.exe
"C:\Program Files (x86)\eQHpWW\eQHpWW.exe"
1⤵
PID:1972

C:\Program Files (x86)\eQHpWW\eQHpWW.exe
"C:\Program Files (x86)\eQHpWW\eQHpWW.exe"
1⤵
PID:2068

C:\Program Files (x86)\1j1RuQ\9Ow9R1QF.exe
"C:\Program Files (x86)\1j1RuQ\9Ow9R1QF.exe"
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\1j1RuQ\XPSPLOG.dll
Size 1.8MB
SHA256 65794e29794f0b425fd98f1ca2a5f385f738e056cb723051f671677924a516e3
MD5 afd722a683a3b6ad91f59ea13977d053
SHA1 86ba051965efff7f956e5a7e37e99a7022074cc5
SHA512 4adf2f01fa15cf33c4ef154f1a2b6a2f20b5927206a79e5bc15ce6a028225140af587fe2357e7acc8db73ef12c54447ef15860d1be8154a5232c12fbe75cbf4c
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXT5tpB1JA6nvsNBFGGLncDYjs:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVT
TLSH
T1F085339BB2DB412EF6D073B52F4CED1CB57E58C881BEC86598E6718B1031AAE103974D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\eQHpWW\XPSPLOG.dll
Size 4.6MB
SHA256 1dee223e77616119060785f41f29384836b5e6db55378cc71eb284dce4437c05
MD5 21d9d4dffdaf94c22a90076551d12caf
SHA1 fde7fa2bbb5ee7cd8498655dc29351be0e09eb68
SHA512 d4c069e3b711edd4b88ad82a723a6eae6324f13f1e9cd630dfa4655b17fe2f19ef7620fd5d680dc465f587412625a348a3660e6dc3c324c79e6d3e11d9559ace
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy+:BMWKfU+BcUTHCCCfqCiUffn+
TLSH
T16F263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\eQHpWW\XPSPLOG.dll
Size 640KB
SHA256 4c62579886ac7b2188b786ba37fbd437d9f3caba879aeb96f3c29732f3e77813
MD5 ea07506c7f491ce575d4c15f07700c70
SHA1 4b7b2b1cd42dbb1a566d747cddfdfc11772796f7
SHA512 7e426f9a284034c682fec688afa497945681b6e86c30033ea504e58e3dfeb17e442b2525be361e0b936452a904756752c043abd84a4dc7589ecfcc1a018c11b4
SSDEEP 12288:6Qls2PLOuWhkdNkXDKLReoDhRyoTU0UoRclIp6W6HfSqwkRP:RTOuWhLK5RyoT9xcjWa
TLSH
T1EDD422926292552FFE4576720F8CFD6C71FAA0E8127ACD69B8C4758308B79F9603814F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eQHpWW.exe

Path C:\Program Files (x86)\eQHpWW\eQHpWW.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\eQHpWW\image.png
Size 4.8MB
SHA256 243bf236faef89eab9a9b4b700ae8758cdfdf24a73e999242b08de2982e95b5a
MD5 5e22fb6bc8fc7c268be69f5b4a9f7a53
SHA1 c84708323e45f9a9a7b73c6a2753313c6ea6d33d
SHA512 cb239b0a12fd6c81a9b8522fc2b0b135bb178e2590f2c89b9fc8396c90951e0e7ce6c67234e2e5189783b287887cc04f4242127dc9673cf0a070b07b209d21c4
SSDEEP 98304:D/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:DMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1B136334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\eQHpWW\thumbs.db
Size 358KB
SHA256 eb83a08cb4e18e65dce0b70466da57c290208e528a7bf1799edcc085ec5e0992
MD5 b6b48525926d4d5466be9d9fc39de12b
SHA1 ffbe2405a4d426e18c3579957780d7733ce685e0
SHA512 4e1345e770c786e65331ea494c95efbfa75d6452d2733af42ec3ded858f605a19eb72857d1ed84f2f757c95d159167ead8f1651e004a8db2823a61133a267f42
SSDEEP 6144:fiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:K8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T19B74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 ea128cb84949ece7edcc8eb61120d65635ab4dadc2be9edb268521a76b918f6c
MD5 997c37740c814140159079e7dbecfc0a
SHA1 c620f350c3236f2bffe1cf4422a263479c7da247
SHA512 2f62f0c7b3ef5fd6281f89219bb455c8ab3f2b63dadee651a9283fdee8bf68a6bfc3b96ba71d5f57d85cdcf900405cf39fe185465ad7680173d4fb394b8a73b4
TLSH
T16F3196BB2F6C3DC2DF3A4E8421CAE1261DF9E2849C8504572149C4D8AF483F22F0960D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 17a857e9e04c16c3d6784cb73cb6a1e6f2b8f66faaa2b10b7b00b4d52f009504
MD5 3d9b5dc1e1c7a104321b091f6553c121
SHA1 abc2ea22234c356ac9f153ac522b1196ac14f1c2
SHA512 dd4be7aa238355d42610c5e789e50aaae23023c7b15af10d0c41d669cb2fb4130c7733c9a723b51af850aa049b0ea98ce185c7557f76e0aeaeb4e344da8146e8
TLSH
T1A231F8829F391045DB0C4FB952D1C23FACF5A2A04CA4084B233EC1AB67147B79FD1086
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 3b869246affad6cc2a58e2805dd0a365a00e3bd0ab9b8a35581757b3684abac8
MD5 9ee6dbcaecc1cb7232cb8cf69776d586
SHA1 750ef435f1853c3765cf0ab209d3e9921b15c696
SHA512 0de0aabf19ea505f222dcd073c3cac3179a86e81f477f7781941c9eaed31217d99ce73b3dce963b5fa2082bbcf613cd19dbcfbd93287140ae7a46797daff3794
TLSH
T1E4F0DC1C1839422FF073DD3C87C4B967296BEA26204649A007F8470CE20AD023D92DB1
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 c18e21e86bc82996221a35a3bf654569ddccc9ce82ad36d2f6dab3dd2f0a7397
MD5 6626e4add27fba61227db046874d23d1
SHA1 22b461e79468a93b97d5a7079397b1f0b7899b18
SHA512 7acee37bb17d02ea803eabbdd424d82f5cebd66dab87ba84f319663596ae9ee4222933e0f35fbffb69112bfc6d5b2758d239e14d13bb8cb0100b9643f84163b3
TLSH
T12DF05C1D5BD9111FF13FD6BC07C7BA71AD7AE626140E52AA0AE503457751C003C136BD
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qy0gc1zv.20l.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qy0gc1zv.20l.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Z1h8w3\UxEnhance64.dll
Size 3.1MB
SHA256 eceeb245f6d9fe2a10276ad08c3d27797806e4dc57db93f632d13f9d12126d1c
MD5 8116b309b37aea36a11600bf1802c2ae
SHA1 607525959ef1c7fb8a3b2f2622b6395af2fae2b2
SHA512 b37b32b32f9ddff9a9ef013a5390758e14a48f09c4b6dc088f8ab03fb98244f01d554d29f144a980744b05f604014e0b88e6c80a635f43a27b33e42b617bdf7d
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+p:P9m29xx3Tiqt06ox6+z2rNNrKop
TLSH
T129E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Y5a34c.exe

Path C:\Users\Public\Z1h8w3\Y5a34c.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Z1h8w3\adoresd.dat
Size 4.8MB
SHA256 f85968cc5e77d562d5ce422cf95e0963b269e6e081cf093875710a6b6acbaf50
MD5 c3cbc51f8cef7d3c45de11b7a83d51c0
SHA1 5762bce74983eaded5a22b33307e1b8a04e6e95f
SHA512 bdeb15439a73512778a51da923dd0610379752d3e6e655e92b277616054c27c72dbe75b688d5702d46b2b458eaaa8d7c75e244f7c6c9e388bf822d453fac8034
SSDEEP 98304:pWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:pWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T17F3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Z1h8w3\msadox.tb
Size 8KB
SHA256 b8a335785c03f98bc0ebd6065bfd34f0bfd30618582ab62e5f6c28cb16d3554a
MD5 a41df7a66bc9fe25ee6b0899c67e6a48
SHA1 d75aba018730ad5a3045fea54fcc29934ff28fd9
SHA512 77848d05eeb2d782329bccd01338dbe80cb211dca785af30b18a9d003a6b21b0ae73e8e1f0a68c032ef54639377f95abbe3b4cc3eeeb920231691110a4f0e429
SSDEEP 192:6qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:6sZqZOXQ3uqvR2Kfzp
TLSH
T11A029E06D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2368-606-0x00000207CB5B0000-0x00000207CB5BA000-memory.dmp

Download

memory/2368-604-0x00000207CB590000-0x00000207CB5AE000-memory.dmp

Download

memory/2368-605-0x00000207CB6E0000-0x00000207CB792000-memory.dmp

Download

memory/2368-600-0x00000207CB530000-0x00000207CB552000-memory.dmp

Download

memory/3412-590-0x0000019CD0460000-0x0000019CD0D37000-memory.dmp

Download

memory/3412-593-0x00007FF98DF70000-0x00007FF98DF72000-memory.dmp

Download

memory/3412-592-0x0000019CD0460000-0x0000019CD0D37000-memory.dmp

Download

memory/3412-591-0x0000019CD0460000-0x0000019CD0D37000-memory.dmp

Download

memory/3412-585-0x0000019CD0460000-0x0000019CD0D37000-memory.dmp

Download

memory/3412-584-0x00007FF98DF80000-0x00007FF98DF82000-memory.dmp

Download

memory/3412-580-0x0000019CD0460000-0x0000019CD0D37000-memory.dmp

Download

memory/3412-577-0x00007FF96B340000-0x00007FF96B85E000-memory.dmp

Download

memory/3412-589-0x0000019CD0460000-0x0000019CD0D37000-memory.dmp

Download

memory/4940-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4940-504-0x00007FF981F10000-0x00007FF981F22000-memory.dmp

Download

memory/4940-525-0x00007FF981F10000-0x00007FF981F22000-memory.dmp

Download

memory/4940-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4940-2-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/4940-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5140-686-0x0000000003910000-0x00000000040ED000-memory.dmp

Download

memory/5140-694-0x0000000002F10000-0x0000000002F24000-memory.dmp

Download

memory/5140-682-0x0000000003910000-0x00000000040ED000-memory.dmp

Download

memory/5140-681-0x00000000015E0000-0x00000000015E1000-memory.dmp

Download

memory/5140-679-0x0000000003910000-0x00000000040ED000-memory.dmp

Download

memory/5140-707-0x0000000003910000-0x00000000040ED000-memory.dmp

Download

memory/5140-675-0x00000000750E0000-0x000000007582A000-memory.dmp

Download

memory/5140-674-0x0000000001240000-0x0000000001241000-memory.dmp

Download

memory/5944-562-0x000001679A440000-0x000001679A4CA000-memory.dmp

Download

memory/5944-556-0x00000167996C0000-0x0000016799F97000-memory.dmp

Download

memory/5944-544-0x00000167996C0000-0x0000016799F97000-memory.dmp

Download

memory/5944-539-0x00000167996C0000-0x0000016799F97000-memory.dmp

Download

memory/5944-538-0x00007FF98DF80000-0x00007FF98DF82000-memory.dmp

Download

memory/5944-536-0x00000167996C0000-0x0000016799F97000-memory.dmp

Download

memory/5944-545-0x00000167996C0000-0x0000016799F97000-memory.dmp

Download

memory/5944-546-0x00000167996C0000-0x0000016799F97000-memory.dmp

Download

memory/5944-550-0x00000167996C0000-0x0000016799F97000-memory.dmp

Download

memory/5944-543-0x00000167996C0000-0x0000016799F97000-memory.dmp

Download

memory/5944-559-0x000001679A440000-0x000001679A4CA000-memory.dmp

Download

memory/5944-531-0x00007FF96B340000-0x00007FF96B85E000-memory.dmp

Download

memory/5944-561-0x000001679A440000-0x000001679A4CA000-memory.dmp

Download

memory/5944-560-0x000001679A440000-0x000001679A4CA000-memory.dmp

Download

memory/5944-558-0x000001679A2E0000-0x000001679A32E000-memory.dmp

Download

memory/5944-566-0x00000167996C0000-0x0000016799F97000-memory.dmp

Download

memory/5944-567-0x00000167996C0000-0x0000016799F97000-memory.dmp

Download

memory/5944-530-0x00007FF98DF70000-0x00007FF98DF72000-memory.dmp

Download