a2530fd40eb17db26f1a0ec662a1bf00c71a65a56aaad97e14aa7686050b556f

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Size 38.9MB
Sample261029-3dp45acf93
SHA256 a2530fd40eb17db26f1a0ec662a1bf00c71a65a56aaad97e14aa7686050b556f
MD5 936aa9243c7ac6314b4007e2f986ebc3
SHA1 dc4a26d238cd3cfda1d381ab099efe3dba668191
SHA512 53623e39b428ad50a97c772db3396a61022e469060f5aedb6140081a0d0eeb4da4e5ac8fc550cce82aa0c587e8e39a6ac185ce11b2b1c04f54b2e8bf115d600c
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXA:q6chqTShW/hNbSiQfMJPLmrUlsA
TLSH
T12997D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Q8spay = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Y6Q8F1.exe

Executes dropped EXE 2 IoCs

pid	Process
2380	Y6Q8F1.exe
5624	Y6Q8F1.exe

Loads dropped DLL 2 IoCs

pid	Process
2380	Y6Q8F1.exe
5624	Y6Q8F1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Q8spay\\Y6Q8F1.exe\""	Y6Q8F1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Q8spay\\Y6Q8F1.exe\""	Y6Q8F1.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
720	cmd.exe
5320	cmd.exe
2308	cmd.exe
5208	cmd.exe
1356	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Y6Q8F1.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Y6Q8F1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1280	cmd.exe
1416	cmd.exe
6036	cmd.exe
4744	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Y6Q8F1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Y6Q8F1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4772	schtasks.exe
948	schtasks.exe
5976	schtasks.exe
4036	schtasks.exe
2976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5032	2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe
2380	Y6Q8F1.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2308	2380	Y6Q8F1.exe	101
PID 2308 wrote to memory of 948	2308	cmd.exe	104
PID 2308 wrote to memory of 5288	2308	cmd.exe	105
PID 2308 wrote to memory of 4360	2308	cmd.exe	108
PID 2380 wrote to memory of 5208	2380	Y6Q8F1.exe	109
PID 5208 wrote to memory of 5976	5208	cmd.exe	112
PID 2380 wrote to memory of 1356	2380	Y6Q8F1.exe	114
PID 1356 wrote to memory of 4036	1356	cmd.exe	116
PID 1356 wrote to memory of 2548	1356	cmd.exe	117
PID 5208 wrote to memory of 3040	5208	cmd.exe	118
PID 1356 wrote to memory of 6004	1356	cmd.exe	120
PID 5208 wrote to memory of 5596	5208	cmd.exe	121
PID 1280 wrote to memory of 5556	1280	cmd.exe	123
PID 2380 wrote to memory of 720	2380	Y6Q8F1.exe	124
PID 720 wrote to memory of 2976	720	cmd.exe	126
PID 720 wrote to memory of 4480	720	cmd.exe	127
PID 720 wrote to memory of 1892	720	cmd.exe	129
PID 1416 wrote to memory of 1204	1416	cmd.exe	131
PID 6036 wrote to memory of 5900	6036	cmd.exe	132
PID 2380 wrote to memory of 5320	2380	Y6Q8F1.exe	133
PID 5320 wrote to memory of 4772	5320	cmd.exe	135
PID 5320 wrote to memory of 4584	5320	cmd.exe	136
PID 5320 wrote to memory of 4700	5320	cmd.exe	138
PID 4744 wrote to memory of 5664	4744	cmd.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_936aa9243c7ac6314b4007e2f986ebc3_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5032

C:\Users\Public\Q8spay\Y6Q8F1.exe
C:\Users\Public\Q8spay\Y6Q8F1.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Q8spay\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Q8spay\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5288
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2548
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4584
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4700

C:\Users\Public\Q8spay\Y6Q8F1.exe
"C:\Users\Public\Q8spay\Y6Q8F1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:5624

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Q8spay" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Q8spay" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5556

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4064

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1204

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5900

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 f3bd244a1885b573b71507eebee1cf78c564f839d84c5b342b2e23e912a61622
MD5 a5e8c6a8dcf619e9b8d2c7edbd243f25
SHA1 b83e568f109fbb2fa46b749b12c18fab8fd8e84c
SHA512 b5b2a8cef2b631d2f742fc5a97fd11a3bab85b4681adc107bf30436f24bfe61efce5f604befafed419428d73b04e1742feaeba8bf011bc3bf815d6e61128b179
TLSH
T1D931C6B75F6DBD829F3A4E5022CAF13328E5E1806CE560AA2020C4546F4C3F12F5E90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 cb6227fa2a1eb44392cb51140a03e298dd970cb5fbbc3e595e9fe74a3881a8da
MD5 6fedf93c9e6dd440626df953faaaf8e9
SHA1 319f79750c3d2fb854c59720be0d64cddf423b03
SHA512 29af1db5a880ace654a413186f5b8e32d21a31f29dabe2c4b17d101144b0fb2ad80a009fc4b1f78d6ec379d54d90392fc0d54393676d5b22c71e2d0d7bc349b0
TLSH
T1FB31D69A8E7C6013CF0C4F3566E0C63B7DF562359CE84812293EC1BA8549B776FC6444
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 cfd0724a2aa2d6f7dea31316bfd08cea3735f3013ce8d2090fef7be537aed82e
MD5 8709a284bc3d0c6d4e4fddfaf7d8a680
SHA1 25eedcd18bc974d731a36655a8685a2891b803c4
SHA512 4831eba41b76d674e0adc927c82e58c76ea7bb3b88c8e8622d2f521bea3ab957c1a5ca104c625b10fdb0af01a6c7522b40ea705736427f8852695a2b08407f5b
TLSH
T15FF0DC0445BC412DF032D93EC7D939E5297BFB023047449803A04B0DA2539033C52137
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 d774be272a3f1783e076eea08adab6a528fbdb5efe7a5f1cadec20cc43e9cf5b
MD5 ed96d6af8f65f2ccaca129a9c097d82c
SHA1 2a37ba22cacdc57f26e464249eb478f18fa60ef7
SHA512 b9f80666bc912ab6dd12192950d6398331567b1a6944f881909e9fd50e6f90e6cef52b4d85e6f9ca9ce4eb82355db0cfea6fa2c7cd402300558cb083e8974a19
TLSH
T13DF0EC3E56E9811FF036D5B54AD6BAF28D76F723104671BE0AB603459E95E002C9122A
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Q8spay\UxEnhance64.dll
Size 3.1MB
SHA256 6fe9b166f2e324eca7bb6ed3aa3fba52c84e6b28bf8f56c9175bd2892ee0af73
MD5 c565d681c39efa0ab110d35447905495
SHA1 3ad086166ba44ccd53830dc109cabd4528d9cf39
SHA512 d615d4f820a740358b7f4d329f5cbdcf37fbb1b925608c3c9fd3a33e1deb9b49ef8cf5a51506f2e380a79a3cf69f9ab57ed5f61969da17fd704db8c7de0336ae
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+w:P9m29xx3Tiqt06ox6+z2rNNrKow
TLSH
T112E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Y6Q8F1.exe

Path C:\Users\Public\Q8spay\Y6Q8F1.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Q8spay\adoresd.dat
Size 4.8MB
SHA256 a24fba9049ca2d494a03501638bd91cd8a724b2464042cc520101fb2b2a19015
MD5 c3964bb1ec16fedb1720a4326eaf931e
SHA1 3e2b9bc9f0ad1f1ac67be577a3df134700d6a193
SHA512 3a5894a05e74e88fe173aa07611919991cde401933e6d8272ead716a979448763eb71eef12db2f5c465d7a96c4e80a811fc3dadc547a7fc3358db63b6bbcfece
SSDEEP 98304:+Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:+Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1DE3633AF2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Q8spay\msadox.tb
Size 8KB
SHA256 e3ada810ce5be72727bbfaaafd5639e570dd10e3956f7874be87a2f8b2cb8a00
MD5 c16e384a77848747abfbd78441d10433
SHA1 7de042f7a2028c97822c2ba34d4c9978ce91b687
SHA512 913943e02d55a311a41eeb72ed5c5b5247285d5c88fe3cf3b06f2b6a18389e1d383a4d16030f96282999074692cb663a37006c4344b6a5b18d5246647d02ea13
SSDEEP 192:JqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:JsZqZOXQ3uqvR2Kfzp
TLSH
T1C1029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiPolicy.p7b

Path C:\Windows\System32\CodeIntegrity\SiPolicy.p7b
Size 24KB
SHA256 b3f17065ed63b17ffef175f2979907d8eef69a76ba4cbd1d9785035a0b1f0a10
MD5 c99441a9b83d3866d88abfdf45894d3d
SHA1 3e32a4131855a8296b6238294a03d8eabcad6f9c
SHA512 c13bb76ef20055b5e923272c4cd976e93e5f21c5b7f8664e5d60a4918e92d0ab4abd3efa63a549b52536986fc3434a9ef1f808be76a12f47e43fdd9e58f275f6
SSDEEP 48:GwIn0NHUVyHU1yHUccy3GwaAvdV6dVwNdVojdVKdVqdmded9dod1d9Ud0dOdbd81:Any8yU88yldGVDP4NMC2/22M/0rw
TLSH
T11CB2C6803BEEC559F3B3DA71AFB6C6AA903AFC91AD11531F71C9735E1432800D529B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2380-558-0x0000014D55620000-0x0000014D556AA000-memory.dmp

Download

memory/2380-535-0x0000014D547F0000-0x0000014D550C7000-memory.dmp

Download

memory/2380-529-0x00007FFEDC870000-0x00007FFEDC872000-memory.dmp

Download

memory/2380-538-0x0000014D547F0000-0x0000014D550C7000-memory.dmp

Download

memory/2380-542-0x0000014D547F0000-0x0000014D550C7000-memory.dmp

Download

memory/2380-537-0x00007FFEDC880000-0x00007FFEDC882000-memory.dmp

Download

memory/2380-543-0x0000014D547F0000-0x0000014D550C7000-memory.dmp

Download

memory/2380-545-0x0000014D547F0000-0x0000014D550C7000-memory.dmp

Download

memory/2380-544-0x0000014D547F0000-0x0000014D550C7000-memory.dmp

Download

memory/2380-549-0x0000014D547F0000-0x0000014D550C7000-memory.dmp

Download

memory/2380-554-0x0000014D547F0000-0x0000014D550C7000-memory.dmp

Download

memory/2380-563-0x0000014D547F0000-0x0000014D550C7000-memory.dmp

Download

memory/2380-561-0x0000014D55620000-0x0000014D556AA000-memory.dmp

Download

memory/2380-560-0x0000014D55620000-0x0000014D556AA000-memory.dmp

Download

memory/2380-559-0x0000014D55620000-0x0000014D556AA000-memory.dmp

Download

memory/2380-595-0x0000014D547F0000-0x0000014D550C7000-memory.dmp

Download

memory/2380-557-0x0000014D55520000-0x0000014D5556E000-memory.dmp

Download

memory/2380-530-0x00007FFEBFF50000-0x00007FFEC046E000-memory.dmp

Download

memory/5032-523-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/5032-524-0x00007FFED5580000-0x00007FFED5590000-memory.dmp

Download

memory/5032-503-0x00007FFED5580000-0x00007FFED5590000-memory.dmp

Download

memory/5032-1-0x00000000001F0000-0x00000000001FC000-memory.dmp

Download

memory/5032-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/5624-585-0x00007FFEDC880000-0x00007FFEDC882000-memory.dmp

Download

memory/5624-598-0x000001B157460000-0x000001B157D37000-memory.dmp

Download

memory/5624-590-0x000001B157460000-0x000001B157D37000-memory.dmp

Download

memory/5624-591-0x000001B157460000-0x000001B157D37000-memory.dmp

Download

memory/5624-593-0x000001B157460000-0x000001B157D37000-memory.dmp

Download

memory/5624-592-0x000001B157460000-0x000001B157D37000-memory.dmp

Download

memory/5624-583-0x000001B157460000-0x000001B157D37000-memory.dmp

Download

memory/5624-586-0x000001B157460000-0x000001B157D37000-memory.dmp

Download

memory/5624-580-0x00007FFEBFF50000-0x00007FFEC046E000-memory.dmp

Download

memory/5624-611-0x000001B157E70000-0x000001B157EFA000-memory.dmp

Download

memory/5624-617-0x000001B157460000-0x000001B157D37000-memory.dmp

Download

memory/5624-616-0x000001B157460000-0x000001B157D37000-memory.dmp

Download

memory/5624-610-0x000001B157E70000-0x000001B157EFA000-memory.dmp

Download

memory/5624-609-0x000001B157E70000-0x000001B157EFA000-memory.dmp

Download

memory/5624-608-0x000001B157E70000-0x000001B157EFA000-memory.dmp

Download

memory/5624-605-0x000001B157460000-0x000001B157D37000-memory.dmp

Download