9c391614d531aa59a4867cbbe57658e537510a08ceb252dfef7b327e7681d1f5

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Size 38.9MB
Sample261030-3khzdss18j
SHA256 9c391614d531aa59a4867cbbe57658e537510a08ceb252dfef7b327e7681d1f5
MD5 80a6e79252018918cb67c412b5640f4b
SHA1 273e488649f1ae55864429f375a8d23ebb315811
SHA512 154290e92e2b3b1f7590dba9417024f18a7d51311f068da01a272e71e6427a534b1da0f7f9cecab35ce9f506e9fe4f177d961bf26e19c6126ddebfd9b6750910
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXJ:q6chqTShW/hNbSiQfMJPLmrUlsJ
TLSH
T1DD97D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\nP9lzr = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	0fPlrS.exe

Executes dropped EXE 2 IoCs

pid	Process
1604	0fPlrS.exe
2988	0fPlrS.exe

Loads dropped DLL 2 IoCs

pid	Process
1604	0fPlrS.exe
2988	0fPlrS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\nP9lzr\\0fPlrS.exe\""	0fPlrS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\nP9lzr\\0fPlrS.exe\""	0fPlrS.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2468	cmd.exe
4740	cmd.exe
1216	cmd.exe
2392	cmd.exe
3472	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	0fPlrS.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	0fPlrS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3800	cmd.exe
2904	cmd.exe
4776	cmd.exe
1656	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0fPlrS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0fPlrS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2388	schtasks.exe
1484	schtasks.exe
3632	schtasks.exe
3500	schtasks.exe
3596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5084	2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe
1604	0fPlrS.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 3472	1604	0fPlrS.exe	95
PID 3472 wrote to memory of 2388	3472	cmd.exe	97
PID 3472 wrote to memory of 4784	3472	cmd.exe	98
PID 3472 wrote to memory of 3368	3472	cmd.exe	101
PID 1604 wrote to memory of 2468	1604	0fPlrS.exe	103
PID 2468 wrote to memory of 1484	2468	cmd.exe	107
PID 4776 wrote to memory of 4900	4776	cmd.exe	108
PID 1604 wrote to memory of 4740	1604	0fPlrS.exe	109
PID 2468 wrote to memory of 3640	2468	cmd.exe	111
PID 4740 wrote to memory of 3632	4740	cmd.exe	114
PID 4740 wrote to memory of 2796	4740	cmd.exe	115
PID 2468 wrote to memory of 4020	2468	cmd.exe	116
PID 4740 wrote to memory of 4580	4740	cmd.exe	117
PID 1656 wrote to memory of 2588	1656	cmd.exe	118
PID 1604 wrote to memory of 1216	1604	0fPlrS.exe	119
PID 1216 wrote to memory of 3500	1216	cmd.exe	121
PID 1216 wrote to memory of 3848	1216	cmd.exe	122
PID 1216 wrote to memory of 3088	1216	cmd.exe	125
PID 3800 wrote to memory of 4980	3800	cmd.exe	126
PID 1604 wrote to memory of 2392	1604	0fPlrS.exe	127
PID 2392 wrote to memory of 3596	2392	cmd.exe	129
PID 2392 wrote to memory of 332	2392	cmd.exe	130
PID 2392 wrote to memory of 620	2392	cmd.exe	133
PID 2904 wrote to memory of 3240	2904	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_80a6e79252018918cb67c412b5640f4b_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5084

C:\Users\Public\nP9lzr\0fPlrS.exe
C:\Users\Public\nP9lzr\0fPlrS.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\nP9lzr\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\nP9lzr\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4784
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2796
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3500
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3596
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:332
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:620

C:\Users\Public\nP9lzr\0fPlrS.exe
"C:\Users\Public\nP9lzr\0fPlrS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2988

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\nP9lzr" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\nP9lzr" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4900

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1992

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2588

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4980

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 dad7f50ce3633b30a865c4d479b9123ce184e37ac6e0b9624cc7a6d486d9b1cf
MD5 b60f86c179ab6b0062da7961c84577c5
SHA1 a797d5b36f56bf2f081acbfe4da1a73efb323932
SHA512 2acac099eaf5596d49feb31a246ce9489f676c560cb8552d703d9c705df2e940b96c4c232a3d44031f24cbad2b1c1219948d83e933a75ca8e68ce747ca801765
TLSH
T1CD31A4BB1FFA2D879F294D9424DDE5361DF6E1906C8A00C95204C4A95E083F12E4E60D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 7eb75e135e71683167a98dcf6fae1a6d47d65148ee2a2bf14e2b7b376deeec7d
MD5 eee3b032769d4e96f1049e0f510f5a21
SHA1 6f17d06af54ddd9ddff8739d0b264c4540419b66
SHA512 d7c3c0fc20f004cea778b67e23ad31856c92711742fb869ee4fb719a164ee8ddba62452052bd659368ed7f5427f96df59db6bfd39ccc4f8fd9914f78454f0f29
TLSH
T1F731C4839E3950038F081F2962C0D13B6CF095208CE80852B12ED26B4A17B775F87400
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 4695e192f6f6804eec92dec5b50bc2c53200982b738c56c1ecd51285ef9beb15
MD5 f839714dd0bc8a19e704eefae1eb97cb
SHA1 1e8716956428f9f73e8df96c7e721f253d652f41
SHA512 1436118b48380ae9e91a56a7d1ce27e814ef41484294535726bed08112e073525354995ae638e87626208ac528e7d2a02ae101f6ebdbcb4e599b366d77b57d11
TLSH
T15BF097280878113CF133DA3D87DDB5DA0E7BE602240748980AE1070CA2814062C925B5
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 5347ef9948e8f735912528aaac2a0b49be27a783338222eee5ab48a3d35671d5
MD5 91e6f1e1b20341a4b68bb9b28c30e59c
SHA1 5e96d97989217f07b4c4581d4853ee134299ace8
SHA512 943939063c25af3e4406243af6510d67f545adc8e6dead4e19e21d9e399a01c62b7cdd0781fe2b69e5c75377ef586316630e14defae882ef1b978d9ea998943b
TLSH
T11FF0A33545D9121FF17F91B447DB3E726639E523680A35A98F6D1348BF61B004C4127C
MD5 SHA1 SHA512 TLSH

Submit Download

0fPlrS.exe

Path C:\Users\Public\nP9lzr\0fPlrS.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\nP9lzr\UxEnhance64.dll
Size 3.1MB
SHA256 0356cac4313e711605beef5aa2a1ad835220f3a64833e493651280170e5402bb
MD5 a7843fbc2790e780cdff5e69887a3163
SHA1 436c7497c3268fd0d4375bc400560da77c6e5abe
SHA512 57252525dc4a6ea1645f926e3dbc489296a66f8fedbb87848059669d5908d160e1407e305f8e04b8bf173924445a1c5ac0a6536dfbb6ddd2500f9209d503a8f6
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+m:P9m29xx3Tiqt06ox6+z2rNNrKom
TLSH
T114E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\nP9lzr\adoresd.dat
Size 4.8MB
SHA256 cc2e5e9dd06ff660ec56dbbc413309a15eb9f74e0ee8ce49983193f72a9b448b
MD5 849e032432bee08427e5c1c2c9279496
SHA1 827752665f662f2fc42e69bc80cd96bee74542b1
SHA512 35313d3b6b5bfc9911501be6f8fdcc95c0963336d6f46f3277082ce6279b7d6037394a98b96b7fe55c0ae0feb5ce2bae00d907256c234fa24a4db2e230b36d3e
SSDEEP 98304:RWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:RWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1393633AF2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\nP9lzr\msadox.tb
Size 8KB
SHA256 fc095dc8ee651c99376d16acae3365bbee6e3d901258831fbe67d55fb91f8b30
MD5 c3b7f3dfafb5ed6f19ded9a8aa111628
SHA1 7c848212e7cb0efde95ce6655563f55f16f62fb1
SHA512 c6022486e716394e76744e6796ed275f3733323d1356bf823a6f48f953f6954a0efedf95a6c0bf16daffb035d22cacd26e076149d852eecb65ffc757249dcf84
SSDEEP 192:TqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:TsZqZOXQ3uqvR2Kfzp
TLSH
T1DC029E05D7A20CC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiPolicy.p7b

Path C:\Windows\System32\CodeIntegrity\SiPolicy.p7b
Size 24KB
SHA256 b3f17065ed63b17ffef175f2979907d8eef69a76ba4cbd1d9785035a0b1f0a10
MD5 c99441a9b83d3866d88abfdf45894d3d
SHA1 3e32a4131855a8296b6238294a03d8eabcad6f9c
SHA512 c13bb76ef20055b5e923272c4cd976e93e5f21c5b7f8664e5d60a4918e92d0ab4abd3efa63a549b52536986fc3434a9ef1f808be76a12f47e43fdd9e58f275f6
SSDEEP 48:GwIn0NHUVyHU1yHUccy3GwaAvdV6dVwNdVojdVKdVqdmded9dod1d9Ud0dOdbd81:Any8yU88yldGVDP4NMC2/22M/0rw
TLSH
T11CB2C6803BEEC559F3B3DA71AFB6C6AA903AFC91AD11531F71C9735E1432800D529B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1604-560-0x0000013CD9240000-0x0000013CD92CA000-memory.dmp

Download

memory/1604-536-0x0000013CD8430000-0x0000013CD8D07000-memory.dmp

Download

memory/1604-531-0x00007FFF60D80000-0x00007FFF6129E000-memory.dmp

Download

memory/1604-530-0x00007FFF7F710000-0x00007FFF7F712000-memory.dmp

Download

memory/1604-539-0x0000013CD8430000-0x0000013CD8D07000-memory.dmp

Download

memory/1604-538-0x00007FFF7F720000-0x00007FFF7F722000-memory.dmp

Download

memory/1604-543-0x0000013CD8430000-0x0000013CD8D07000-memory.dmp

Download

memory/1604-545-0x0000013CD8430000-0x0000013CD8D07000-memory.dmp

Download

memory/1604-546-0x0000013CD8430000-0x0000013CD8D07000-memory.dmp

Download

memory/1604-544-0x0000013CD8430000-0x0000013CD8D07000-memory.dmp

Download

memory/1604-550-0x0000013CD8430000-0x0000013CD8D07000-memory.dmp

Download

memory/1604-555-0x0000013CD8430000-0x0000013CD8D07000-memory.dmp

Download

memory/1604-563-0x0000013CD9240000-0x0000013CD92CA000-memory.dmp

Download

memory/1604-562-0x0000013CD9240000-0x0000013CD92CA000-memory.dmp

Download

memory/1604-561-0x0000013CD9240000-0x0000013CD92CA000-memory.dmp

Download

memory/1604-596-0x0000013CD8430000-0x0000013CD8D07000-memory.dmp

Download

memory/1604-559-0x0000013CD9140000-0x0000013CD918E000-memory.dmp

Download

memory/1604-558-0x0000013CD8430000-0x0000013CD8D07000-memory.dmp

Download

memory/2988-594-0x0000028811D20000-0x00000288125F7000-memory.dmp

Download

memory/2988-593-0x0000028811D20000-0x00000288125F7000-memory.dmp

Download

memory/2988-618-0x0000028811D20000-0x00000288125F7000-memory.dmp

Download

memory/2988-617-0x0000028811D20000-0x00000288125F7000-memory.dmp

Download

memory/2988-577-0x00007FFF60D80000-0x00007FFF6129E000-memory.dmp

Download

memory/2988-580-0x0000028811D20000-0x00000288125F7000-memory.dmp

Download

memory/2988-586-0x00007FFF7F720000-0x00007FFF7F722000-memory.dmp

Download

memory/2988-592-0x0000028811D20000-0x00000288125F7000-memory.dmp

Download

memory/2988-587-0x0000028811D20000-0x00000288125F7000-memory.dmp

Download

memory/2988-591-0x0000028811D20000-0x00000288125F7000-memory.dmp

Download

memory/2988-610-0x0000028811250000-0x00000288112DA000-memory.dmp

Download

memory/2988-611-0x0000028811250000-0x00000288112DA000-memory.dmp

Download

memory/2988-612-0x0000028811250000-0x00000288112DA000-memory.dmp

Download

memory/2988-599-0x0000028811D20000-0x00000288125F7000-memory.dmp

Download

memory/2988-606-0x0000028811D20000-0x00000288125F7000-memory.dmp

Download

memory/2988-609-0x0000028811250000-0x00000288112DA000-memory.dmp

Download

memory/5084-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/5084-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/5084-525-0x00007FFF70AF0000-0x00007FFF70B00000-memory.dmp

Download

memory/5084-524-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/5084-2-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/5084-504-0x00007FFF70AF0000-0x00007FFF70B00000-memory.dmp

Download