683e3bdd32a1b00f4d6a877209f165e55282d23c0c4ecc3b9cc5731209c56057

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Size 32.4MB
Sample261102-vmkl1ady4r
SHA256 683e3bdd32a1b00f4d6a877209f165e55282d23c0c4ecc3b9cc5731209c56057
MD5 ff0f343d9dc5a3b97196c1ac2897380a
SHA1 1ae78f3e7b508a6afd3b0057097412266abf2d36
SHA512 60813f3f79729e57bc89d15eeaae72bca340c2ca9c19ad627800de0635c114324ba14bda7bbf4c0cfc15ec8ea43e56c8569608214a5381cdeb60932eef7c829a
SSDEEP 196608:SqEfM3r4vGOgAVAiZfFK0SBqtiEPFNPTP:a6qpz
TLSH
T129770646FA414DD2F85846F588ABB7A023FEBD7582D1C30721D87325AFAF29C0E93195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Vijluy.exe

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\ku8Iok = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/4052-699-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 6 IoCs

resource	yara_rule
behavioral2/memory/4052-682-0x0000000003D50000-0x000000000452D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4052-686-0x0000000003D50000-0x000000000452D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4052-695-0x0000000003D50000-0x000000000452D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4052-721-0x0000000003D50000-0x000000000452D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4052-735-0x0000000003D50000-0x000000000452D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2032-745-0x0000000003B60000-0x000000000433D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2992	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Vijluy.exe

Executes dropped EXE 6 IoCs

pid	Process
5960	3Bbx0c.exe
696	3Bbx0c.exe
4052	Vijluy.exe
1116	Vijluy.exe
5044	Vijluy.exe
2032	x268kj0r.exe

Loads dropped DLL 5 IoCs

pid	Process
5960	3Bbx0c.exe
696	3Bbx0c.exe
4052	Vijluy.exe
1116	Vijluy.exe
2032	x268kj0r.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4788	icacls.exe
5400	icacls.exe
1328	icacls.exe
3520	icacls.exe
5892	icacls.exe
2664	icacls.exe
1396	icacls.exe
5908	icacls.exe
972	icacls.exe
5524	icacls.exe
5024	icacls.exe
2256	icacls.exe
1480	icacls.exe
696	icacls.exe
5424	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\ku8Iok\\3Bbx0c.exe\""	3Bbx0c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\dudoFG\\Vijluy.exe\""	Vijluy.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1340	cmd.exe
1784	cmd.exe
3944	cmd.exe
5852	cmd.exe
2344	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	3Bbx0c.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dudoFG\image.png	3Bbx0c.exe
File opened for modification	C:\Program Files (x86)\dudoFG\thumbs.db	3Bbx0c.exe
File opened for modification	C:\Program Files (x86)\71xGvuVRu	Vijluy.exe
File created	C:\Program Files (x86)\71xGvuVRu\x268kj0r.exe	Vijluy.exe
File created	C:\Program Files (x86)\71xGvuVRu\XPSPLOG.dll	Vijluy.exe
File created	C:\Program Files (x86)\dudoFG\Vijluy.exe	3Bbx0c.exe
File created	C:\Program Files (x86)\dudoFG\thumbs.db	3Bbx0c.exe
File opened for modification	C:\Program Files (x86)\dudoFG\XPSPLOG.dll	3Bbx0c.exe
File opened for modification	C:\Program Files (x86)\71xGvuVRu\image.png	Vijluy.exe
File opened for modification	C:\Program Files (x86)\71xGvuVRu\thumbs.db	Vijluy.exe
File opened for modification	C:\Program Files (x86)\dudoFG	3Bbx0c.exe
File created	C:\Program Files (x86)\dudoFG\XPSPLOG.dll	3Bbx0c.exe
File opened for modification	C:\Program Files (x86)\dudoFG\Vijluy.exe	3Bbx0c.exe
File created	C:\Program Files (x86)\71xGvuVRu\image.png	Vijluy.exe
File opened for modification	C:\Program Files (x86)\71xGvuVRu\x268kj0r.exe	Vijluy.exe
File opened for modification	C:\Program Files (x86)\71xGvuVRu\XPSPLOG.dll	Vijluy.exe
File opened for modification	C:\Program Files (x86)\dudoFG\image.png	3Bbx0c.exe
File created	C:\Program Files (x86)\71xGvuVRu\thumbs.db	Vijluy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaveActive = "0"	Vijluy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Vijluy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\SCRNSAVE.EXE	Vijluy.exe

Executes a command shell one-liner 1 TTPs 19 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1232	cmd.exe
5860	cmd.exe
5824	cmd.exe
5828	cmd.exe
1280	cmd.exe
840	cmd.exe
6044	cmd.exe
4408	cmd.exe
4780	cmd.exe
2804	cmd.exe
2976	cmd.exe
6096	cmd.exe
3436	cmd.exe
4512	cmd.exe
3432	cmd.exe
2644	cmd.exe
2500	cmd.exe
5964	cmd.exe
456	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3Bbx0c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3Bbx0c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Vijluy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Vijluy.exe

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x268kj0r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vijluy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vijluy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaveActive = "0"	Vijluy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Vijluy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	Vijluy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\SCRNSAVE.EXE	Vijluy.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1480	schtasks.exe
4256	schtasks.exe
5524	schtasks.exe
2372	schtasks.exe
4432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3188	2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe
5960	3Bbx0c.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeIncreaseQuotaPrivilege	2992	powershell.exe
Token: SeSecurityPrivilege	2992	powershell.exe
Token: SeTakeOwnershipPrivilege	2992	powershell.exe
Token: SeLoadDriverPrivilege	2992	powershell.exe
Token: SeSystemProfilePrivilege	2992	powershell.exe
Token: SeSystemtimePrivilege	2992	powershell.exe
Token: SeProfSingleProcessPrivilege	2992	powershell.exe
Token: SeIncBasePriorityPrivilege	2992	powershell.exe
Token: SeCreatePagefilePrivilege	2992	powershell.exe
Token: SeBackupPrivilege	2992	powershell.exe
Token: SeRestorePrivilege	2992	powershell.exe
Token: SeShutdownPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeSystemEnvironmentPrivilege	2992	powershell.exe
Token: SeRemoteShutdownPrivilege	2992	powershell.exe
Token: SeUndockPrivilege	2992	powershell.exe
Token: SeManageVolumePrivilege	2992	powershell.exe
Token: 33	2992	powershell.exe
Token: 34	2992	powershell.exe
Token: 35	2992	powershell.exe
Token: 36	2992	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 2992	5960	3Bbx0c.exe	91
PID 5960 wrote to memory of 1340	5960	3Bbx0c.exe	92
PID 1340 wrote to memory of 1480	1340	cmd.exe	96
PID 5960 wrote to memory of 1784	5960	3Bbx0c.exe	98
PID 1340 wrote to memory of 4652	1340	cmd.exe	100
PID 1784 wrote to memory of 4256	1784	cmd.exe	101
PID 5960 wrote to memory of 3944	5960	3Bbx0c.exe	104
PID 1340 wrote to memory of 2468	1340	cmd.exe	106
PID 1784 wrote to memory of 2916	1784	cmd.exe	108
PID 3944 wrote to memory of 5524	3944	cmd.exe	109
PID 5960 wrote to memory of 5852	5960	3Bbx0c.exe	110
PID 1784 wrote to memory of 2256	1784	cmd.exe	112
PID 3944 wrote to memory of 5744	3944	cmd.exe	113
PID 5852 wrote to memory of 2372	5852	cmd.exe	114
PID 3944 wrote to memory of 2440	3944	cmd.exe	115
PID 5960 wrote to memory of 2344	5960	3Bbx0c.exe	117
PID 5852 wrote to memory of 4568	5852	cmd.exe	119
PID 2344 wrote to memory of 4432	2344	cmd.exe	121
PID 5852 wrote to memory of 1248	5852	cmd.exe	122
PID 2344 wrote to memory of 3256	2344	cmd.exe	123
PID 2344 wrote to memory of 5636	2344	cmd.exe	124
PID 456 wrote to memory of 5260	456	cmd.exe	125
PID 1280 wrote to memory of 4628	1280	cmd.exe	127
PID 5960 wrote to memory of 4052	5960	3Bbx0c.exe	129
PID 4052 wrote to memory of 2804	4052	Vijluy.exe	131
PID 4052 wrote to memory of 1232	4052	Vijluy.exe	132
PID 4052 wrote to memory of 2976	4052	Vijluy.exe	135
PID 2804 wrote to memory of 4788	2804	cmd.exe	138
PID 4052 wrote to memory of 2644	4052	Vijluy.exe	141
PID 2644 wrote to memory of 3520	2644	cmd.exe	143
PID 4052 wrote to memory of 5828	4052	Vijluy.exe	144
PID 5828 wrote to memory of 5892	5828	cmd.exe	146
PID 4052 wrote to memory of 5824	4052	Vijluy.exe	147
PID 5824 wrote to memory of 5400	5824	cmd.exe	149
PID 4052 wrote to memory of 6096	4052	Vijluy.exe	150
PID 6096 wrote to memory of 1328	6096	cmd.exe	152
PID 4052 wrote to memory of 6044	4052	Vijluy.exe	153
PID 6044 wrote to memory of 1480	6044	cmd.exe	155
PID 4052 wrote to memory of 5860	4052	Vijluy.exe	156
PID 5860 wrote to memory of 2664	5860	cmd.exe	158
PID 4052 wrote to memory of 3436	4052	Vijluy.exe	159
PID 3436 wrote to memory of 696	3436	cmd.exe	161
PID 4052 wrote to memory of 2500	4052	Vijluy.exe	162
PID 2500 wrote to memory of 5024	2500	cmd.exe	164
PID 4052 wrote to memory of 4780	4052	Vijluy.exe	165
PID 4780 wrote to memory of 5524	4780	cmd.exe	167
PID 4052 wrote to memory of 5964	4052	Vijluy.exe	168
PID 5964 wrote to memory of 2256	5964	cmd.exe	170
PID 4052 wrote to memory of 4408	4052	Vijluy.exe	171
PID 4408 wrote to memory of 972	4408	cmd.exe	173
PID 4052 wrote to memory of 3432	4052	Vijluy.exe	174
PID 3432 wrote to memory of 1396	3432	cmd.exe	176
PID 4052 wrote to memory of 4512	4052	Vijluy.exe	177
PID 4512 wrote to memory of 5424	4512	cmd.exe	179
PID 4052 wrote to memory of 840	4052	Vijluy.exe	180
PID 840 wrote to memory of 5908	840	cmd.exe	182

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Vijluy.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_ff0f343d9dc5a3b97196c1ac2897380a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3188

C:\Users\Public\ku8Iok\3Bbx0c.exe
"C:\Users\Public\ku8Iok\3Bbx0c.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ku8Iok\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ku8Iok\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5524
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2372
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4432
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5636
- C:\Program Files (x86)\dudoFG\Vijluy.exe
  "C:\Program Files (x86)\dudoFG\Vijluy.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4052
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3520
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\Vijluy.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\Vijluy.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5400
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\Vijluy.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\Vijluy.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\Vijluy.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\Vijluy.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:696
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5524
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2256
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5424
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\dudoFG\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\dudoFG\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5908

C:\Users\Public\ku8Iok\3Bbx0c.exe
"C:\Users\Public\ku8Iok\3Bbx0c.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ku8Iok" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ku8Iok" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5260

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5492

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4628

C:\Program Files (x86)\dudoFG\Vijluy.exe
"C:\Program Files (x86)\dudoFG\Vijluy.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1116

C:\Program Files (x86)\dudoFG\Vijluy.exe
"C:\Program Files (x86)\dudoFG\Vijluy.exe"
1⤵
- Executes dropped EXE
PID:5044

C:\Program Files (x86)\71xGvuVRu\x268kj0r.exe
"C:\Program Files (x86)\71xGvuVRu\x268kj0r.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\71xGvuVRu\XPSPLOG.dll
Size 4.6MB
SHA256 55c356627bcc7cf7df8efcb13ccc8b80778e7f84bd83456ead2f48416a7f6108
MD5 c2cbd06e44f4440433623467d15b3555
SHA1 e34a888b2a33cce78169f13ab07e0f4f55948fbd
SHA512 6556b11c689eee1908f4ba3b8ad9db9503483a6a11b03bd4b37b4bacee92f50b8340d25c430c9fed0e8a1a6029d1791f9c76deec2839dfe9543fdc415f72c937
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy+:BMWKfU+BcUTHCCCfqCiUffn+
TLSH
T142263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\71xGvuVRu\image.png
Size 4.8MB
SHA256 86259a07c3ccf9b6acbf5e1f2a6322b7eceff95bddd2c8e57fec6ff06fd6c97b
MD5 cce6d0d38b9318a14de3dbf736f862f5
SHA1 5c6f55e0f872dfe9ae138c61e5a0c5b8e9445c4a
SHA512 ff8da4c71da520725ba78a6162549cc297e27610acaff69449a6d0b544aa46dd57c6f2c99ea8b83372309416cb4dfddaac17d5f2aa4cbd6ed4960c8c9cc96b5a
SSDEEP 98304:c/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:cMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T19C36334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vijluy.exe

Path C:\Program Files (x86)\dudoFG\Vijluy.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\dudoFG\XPSPLOG.dll
Size 4.6MB
SHA256 4347ddc51c58bc037706f695e0fac345fa9528f1d117e9ddec84925fcd65baed
MD5 300fd56c862064cba8cf6a77b6552ae4
SHA1 ede303818d0ab82f771fe0e31dd28ef2816aaca3
SHA512 7386858da327ef76f8f2e500dc99e2a6b36d92cbf5b5876edb761517a0ca52c0a44055a2fb14e7458080ed36efbcde348af146514edd435d6f6b422297b9a086
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyB:BMWKfU+BcUTHCCCfqCiUffnB
TLSH
T1C9263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\dudoFG\image.png
Size 4.8MB
SHA256 858aa1a365a832536bee8eab13029f1384b94a2a14a17459d5a28dfdbdc63741
MD5 ae2d59f51a4691779cfc88ca15ddc83c
SHA1 b4bafe11c027f0eb71e29f6e2c8ccd71cbf90c5a
SHA512 d45df73ee26569c519dd9c8851a311ba4a00bf57164f76ccdc322a567b8fe4d49a8a50d38ea05840b7ed04fbfb909acceb5706fb2cb66b0454d1ae69d7c3253f
SSDEEP 98304:f/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:fMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T19E36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\dudoFG\thumbs.db
Size 358KB
SHA256 571e5cdf46d652deb31bbf04804df6c9b18d60e5431b135b2cd78458396e67c0
MD5 6eab7623a78f7236f8c1bb925d99f5e7
SHA1 3e6ae0d7ad4bb4c32d387854104b091f51b81d92
SHA512 b11c7a5f396faf5db2800a6cd622c5c9c2775a7623ade6fc60f1da93eb5982a64f1fc9378a0a90160eea67d08197b3485f4cd80b66954afeb3e9c6d7699621e7
SSDEEP 6144:GiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:J8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1A674F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 941bfc0b425827eb838ded0b0b6955394d64c64eedc5a4b74e78a4c0c95c6d7b
MD5 9b7ae814faec0ed3dde26ea3421d946e
SHA1 00c6f92163d53bf38333b7d6da391ebd27859a5f
SHA512 44dc3c1f27ade1df709a8dda52c0c004bd83581a27aefe6c22400f4a2ed806abd7168832d7dcda4156c38e27d479731fadfd28605fe4958cf8520d6314e20671
TLSH
T15731A4BF5F79BC419F794E4514CAE0261CF5E1905C9A40D92266C0985F0C3A32E0A50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 a318a4924050a5426f3c9dddca095e4933ddf51e3a4d647ab217e0038a32b929
MD5 62c9798a2c7f3eb34600fd0891875e53
SHA1 fafd94dee8533e365cec5214e030b872caca5bb9
SHA512 0b2f506129a13458e88f6ec130dd91d3cebbb391e80fb47cd70d88860cde3514d361af876afc9a86d8fc356aa7b528333e0bc3837f1b54c546c33a4e8e95f6df
TLSH
T14131D6869E3E6012EB088F7562C5C13BBCF4A4349CB8581A353ED16F5709B3B5FC6464
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 d2f0901344f885e20ead72d87730fbaee99d572bca45f3ab6c25027b18bcedb1
MD5 01e106d7d80fddd086fe5d4770ecd863
SHA1 1ba164b4c54d4e44098193502434a4e3b0f150b7
SHA512 f70f6ceca8324a243b0459ec545fbdc3bbf3eadc87791ec89e055afb7e7f3dc78cf264d4f2dd4b473b0afe704eb87d590fe62f1a650aa2e4e9b44b4d0f7c934a
TLSH
T11EF05C184978423CF573DD3886CA799A1BBBF607340A8DA10BA6570CA6427127E91579
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 f91aaff3e497bd47d46c9f7b86460485c0e2e2efedbe426fcd0d7dde6a579937
MD5 67a01833fcce4ec33ce9dbb345a2d634
SHA1 2fcace803d45291541154994f74158900503bc5b
SHA512 c3435ab7403ecaada53dd27e0304e8ffdbb101a1ab7ff8ec54f07eb50df3af46e081b39fc3243740358f4759c8dfc032ed2454f723ffe4b101b129774e037a95
TLSH
T18AF05C3955EE012FF17B86F84EE7B6A19D39F622200B65AF1AE613441EA2C011C4226F
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ceeddwad.i2q.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ceeddwad.i2q.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

3Bbx0c.exe

Path C:\Users\Public\ku8Iok\3Bbx0c.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ku8Iok\UxEnhance64.dll
Size 3.1MB
SHA256 07791ccad39bbebff419d7c21ffb5b7f41f323ba8b2b56c71d6667de452e30d1
MD5 f76a54e7e46d3e329b4d7d048fb47883
SHA1 64467a797c3653c515e259b492aa218036f26de5
SHA512 09f08e182843e7a950afa0bfcd696e34be6de7e114a4acb15f31a3ba6c8c92c977a5d27bcc23bc5772ecd1ab27dc92aa069bfbbff2af34e03b6d3218f07d0cd7
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+G:P9m29xx3Tiqt06ox6+z2rNNrKoG
TLSH
T139E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\ku8Iok\adoresd.dat
Size 4.8MB
SHA256 a68794fa43ad54a0f0089e84c647c1103518e7c0f69d2539463ca21cfb46a8c1
MD5 9d1e30bb2ad5194e6fcd9977088770dc
SHA1 660d5b2c5a97844e97f944170058da243dca675e
SHA512 5af1a05a0e9a504a76463ef51f539ce75f731f5b89883d1bdbe5a6d7254064ad3e888636470393225804e5cdb6070530a34c1e9f6f9c4b47436ed5608b80e9f7
SSDEEP 98304:dWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:dWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1053633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\ku8Iok\msadox.tb
Size 8KB
SHA256 0b88522ea10c12660877c11756d7a265f5bb7867c64ef04970427c186944154c
MD5 f5f22572992424860a8c46c088371312
SHA1 e76780c2af26f1b7cc182e8cc1a7346ba4111f79
SHA512 ffb5385535c8f7946f531f29ebfed967aaaa15aa9466e463f2664068b2d0b632f2eef8fff7ccb0326b0d537cc87a08c11d4addd5f402e1fec188192fda922020
SSDEEP 192:WqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:WsZqZOXQ3uqvR2Kfzp
TLSH
T115029E05D7A20CC7D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-577-0x00007FF821480000-0x00007FF82199E000-memory.dmp

Download

memory/696-580-0x000002332CD90000-0x000002332D667000-memory.dmp

Download

memory/696-589-0x000002332CD90000-0x000002332D667000-memory.dmp

Download

memory/696-590-0x000002332CD90000-0x000002332D667000-memory.dmp

Download

memory/696-588-0x000002332CD90000-0x000002332D667000-memory.dmp

Download

memory/696-591-0x00007FF844350000-0x00007FF844352000-memory.dmp

Download

memory/696-587-0x000002332CD90000-0x000002332D667000-memory.dmp

Download

memory/696-583-0x000002332CD90000-0x000002332D667000-memory.dmp

Download

memory/696-582-0x00007FF844360000-0x00007FF844362000-memory.dmp

Download

memory/1116-731-0x0000000001530000-0x0000000001531000-memory.dmp

Download

memory/1116-732-0x0000000074B60000-0x00000000752AA000-memory.dmp

Download

memory/2032-748-0x0000000001530000-0x0000000001531000-memory.dmp

Download

memory/2032-738-0x0000000073780000-0x0000000073ECA000-memory.dmp

Download

memory/2032-737-0x0000000001530000-0x0000000001531000-memory.dmp

Download

memory/2032-744-0x0000000001990000-0x0000000001991000-memory.dmp

Download

memory/2032-745-0x0000000003B60000-0x000000000433D000-memory.dmp

Download

memory/2032-742-0x0000000003B60000-0x000000000433D000-memory.dmp

Download

memory/2992-600-0x000001A3E0580000-0x000001A3E05A2000-memory.dmp

Download

memory/2992-604-0x000001A3F8AA0000-0x000001A3F8B52000-memory.dmp

Download

memory/2992-603-0x000001A3E05B0000-0x000001A3E05CE000-memory.dmp

Download

memory/2992-606-0x000001A3E05D0000-0x000001A3E05DA000-memory.dmp

Download

memory/3188-2-0x00000000005C0000-0x00000000005CC000-memory.dmp

Download

memory/3188-0-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/3188-524-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/3188-1-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/3188-504-0x00007FF833A80000-0x00007FF833A92000-memory.dmp

Download

memory/3188-525-0x00007FF833A80000-0x00007FF833A92000-memory.dmp

Download

memory/4052-681-0x0000000001B60000-0x0000000001B61000-memory.dmp

Download

memory/4052-682-0x0000000003D50000-0x000000000452D000-memory.dmp

Download

memory/4052-735-0x0000000003D50000-0x000000000452D000-memory.dmp

Download

memory/4052-721-0x0000000003D50000-0x000000000452D000-memory.dmp

Download

memory/4052-699-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4052-695-0x0000000003D50000-0x000000000452D000-memory.dmp

Download

memory/4052-674-0x0000000001B40000-0x0000000001B41000-memory.dmp

Download

memory/4052-675-0x0000000074B60000-0x00000000752AA000-memory.dmp

Download

memory/4052-693-0x0000000003230000-0x0000000003244000-memory.dmp

Download

memory/4052-679-0x0000000003D50000-0x000000000452D000-memory.dmp

Download

memory/4052-686-0x0000000003D50000-0x000000000452D000-memory.dmp

Download

memory/5960-559-0x0000016C09670000-0x0000016C096FA000-memory.dmp

Download

memory/5960-545-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-561-0x0000016C09670000-0x0000016C096FA000-memory.dmp

Download

memory/5960-567-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-560-0x0000016C09670000-0x0000016C096FA000-memory.dmp

Download

memory/5960-558-0x0000016C07DE0000-0x0000016C07E2E000-memory.dmp

Download

memory/5960-556-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-550-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-564-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-562-0x0000016C09670000-0x0000016C096FA000-memory.dmp

Download

memory/5960-538-0x00007FF844360000-0x00007FF844362000-memory.dmp

Download

memory/5960-566-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-546-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-544-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-539-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-543-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-536-0x0000016C0A200000-0x0000016C0AAD7000-memory.dmp

Download

memory/5960-531-0x00007FF821480000-0x00007FF82199E000-memory.dmp

Download

memory/5960-530-0x00007FF844350000-0x00007FF844352000-memory.dmp

Download