amadey | 5a5b14dee63553fb7f57baff9759c8a93720fe56e84cef72395913f34729b3d7

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe
Size 70.5MB
Sample261107-rwpersfb69
SHA256 5a5b14dee63553fb7f57baff9759c8a93720fe56e84cef72395913f34729b3d7
MD5 4dc6b4264577ccae0b00328e37d77984
SHA1 8152990737717184df5493ab316d3e987dfb73bc
SHA512 f9bb51665d6d8dd3383110b80710cba5af9f50ecb015c83d84c28f6795635075ac9ecd0ac4631666416d56e697c9259b6f296a8e6057e2277be193cfc3a49734
SSDEEP 1572864:YuKKUb4L1akqtFUm1mm+KTZhZhXKoWeB3h0RQjE6lEHRqucrc:/KCakqj1h+KdhyViCRJ6OHR
TLSH
T160F73398015FE0B5E5229370C028EB719D03789E971A853F1534688E3BE35BACDDA7DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery downloader execution amadey solaris_loader svcstealer installer loader persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

solaris_loader

Version

193.178.158.57
193.178.158.107
196.251.107.186

Extracted

Family

amadey

Version

5.92

http://193.178.158.107
http://196.251.107.186

Attributes

install_dir
17082f4eef
install_file
Wfeuilcmo.exe
strings_key
51ac028ab14af136529d7c2c3cc0f1b4
url_paths
/Bjsw3DlG1/index.php

/8jdjZhdf7/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
loader solaris_loader
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects Amadey x86-bit Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00100000000243a1-9.dat	family_amadey_v2
behavioral1/files/0x0007000000024452-29.dat	family_amadey_v2

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral1/files/0x0007000000024459-60.dat	family_svcstealer

Custom signature

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024459-60.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024459-60.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/3004-34-0x00000203DD9B0000-0x00000203DD9B2000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/3300-116-0x00000000047A0000-0x00000000047C1000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024459-60.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024467-89.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024459-60.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Custom signature

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024459-60.dat	INDICATOR_SUSPICIOUS_GENInfoStealer

Custom signature

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024459-60.dat	INDICATOR_SUSPICIOUS_References_SecTools

Custom signature

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024459-60.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 17 IoCs

pid	Process
3416	jx7a5byk.exe
2808	dkgaawaf.exe
1720	4bd5en95.exe
1980	lvm3788j.exe
552	synchost.exe
1544	asl66iqa.exe
3892	mx3orqcx.exe
4012	4ozv261r.exe
3264	syshost.exe
396	lvm3788j.tmp
2484	asl66iqa.tmp
2120	ShulkerV2_patched.exe
4008	ntsvckmr.exe
2108	ubgzp.exe
3240	syshost.exe
2840	synchost.exe
3240	synchost.exe

Loads dropped DLL 2 IoCs

pid	Process
396	lvm3788j.tmp
2484	asl66iqa.tmp

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\ntsvckmr.exe"	dkgaawaf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Syshost = "\"C:\\Users\\Admin\\AppData\\Roaming\\syshost.exe\""	4ozv261r.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3416	jx7a5byk.exe
2108	ubgzp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\synchost.job	synchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2656	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 9 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	synchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jx7a5byk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lvm3788j.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mx3orqcx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mx3orqcx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jx7a5byk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lvm3788j.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	asl66iqa.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	asl66iqa.tmp

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	synchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lvm3788j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asl66iqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lvm3788j.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asl66iqa.tmp

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0007000000024450-33.dat	innosetup
behavioral1/memory/1980-31-0x0000000000E00000-0x0000000000F05000-memory.dmp	innosetup
behavioral1/files/0x0007000000024457-54.dat	innosetup
behavioral1/memory/1544-52-0x0000000000DD0000-0x0000000000EB8000-memory.dmp	innosetup
behavioral1/memory/1980-123-0x0000000000E00000-0x0000000000F05000-memory.dmp	innosetup
behavioral1/memory/1544-124-0x0000000000DD0000-0x0000000000EB8000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3416	jx7a5byk.exe
3416	jx7a5byk.exe
3416	jx7a5byk.exe
3416	jx7a5byk.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe
3892	mx3orqcx.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3300	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	jx7a5byk.exe
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeDebugPrivilege	2108	ubgzp.exe
Token: SeDebugPrivilege	3240	syshost.exe
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE
Token: SeShutdownPrivilege	3768	RuntimeBroker.exe
Token: SeShutdownPrivilege	3768	RuntimeBroker.exe
Token: SeShutdownPrivilege	3300	Explorer.EXE
Token: SeCreatePagefilePrivilege	3300	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 3416	4940	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	84
PID 4940 wrote to memory of 2808	4940	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	85
PID 4940 wrote to memory of 1720	4940	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	86
PID 4940 wrote to memory of 1980	4940	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	88
PID 1720 wrote to memory of 552	1720	4bd5en95.exe	87
PID 3416 wrote to memory of 3004	3416	jx7a5byk.exe	51
PID 3416 wrote to memory of 3300	3416	jx7a5byk.exe	56
PID 3416 wrote to memory of 3768	3416	jx7a5byk.exe	60
PID 3416 wrote to memory of 3980	3416	jx7a5byk.exe	62
PID 3416 wrote to memory of 4516	3416	jx7a5byk.exe	65
PID 4940 wrote to memory of 1544	4940	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	89
PID 4940 wrote to memory of 3892	4940	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	90
PID 4940 wrote to memory of 4012	4940	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	91
PID 4012 wrote to memory of 3264	4012	4ozv261r.exe	92
PID 1980 wrote to memory of 396	1980	lvm3788j.exe	93
PID 1544 wrote to memory of 2484	1544	asl66iqa.exe	94
PID 3300 wrote to memory of 412	3300	Explorer.EXE
PID 3300 wrote to memory of 1628	3300	Explorer.EXE
PID 3300 wrote to memory of 4308	3300	Explorer.EXE
PID 4940 wrote to memory of 2120	4940	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	98
PID 3240 wrote to memory of 3300	3240	syshost.exe	56
PID 3892 wrote to memory of 1248	3892	mx3orqcx.exe	112
PID 3892 wrote to memory of 1248	3892	mx3orqcx.exe	112
PID 3892 wrote to memory of 3264	3892	mx3orqcx.exe	115
PID 3892 wrote to memory of 3264	3892	mx3orqcx.exe	115
PID 3892 wrote to memory of 2656	3892	mx3orqcx.exe	116
PID 2656 wrote to memory of 3664	2656	cmd.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3004

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Users\Admin\AppData\Local\Temp\jx7a5byk.exe
    "C:\Users\Admin\AppData\Local\Temp\jx7a5byk.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\dkgaawaf.exe
    "C:\Users\Admin\AppData\Local\Temp\dkgaawaf.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2808
- - C:\Users\Admin\AppData\Local\Temp\4bd5en95.exe
    "C:\Users\Admin\AppData\Local\Temp\4bd5en95.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Users\Admin\AppData\Roaming\synchost.exe
      "C:\Users\Admin\AppData\Roaming\synchost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:552
- - C:\Users\Admin\AppData\Local\Temp\lvm3788j.exe
    "C:\Users\Admin\AppData\Local\Temp\lvm3788j.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\is-BOKVVMRQWU.tmp\lvm3788j.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BOKVVMRQWU.tmp\lvm3788j.tmp" /SL5="$9023A,3706437,1005568,C:\Users\Admin\AppData\Local\Temp\lvm3788j.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:396
- - C:\Users\Admin\AppData\Local\Temp\asl66iqa.exe
    "C:\Users\Admin\AppData\Local\Temp\asl66iqa.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\is-IRFCGNSBMK.tmp\asl66iqa.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-IRFCGNSBMK.tmp\asl66iqa.tmp" /SL5="$C0066,2708255,888832,C:\Users\Admin\AppData\Local\Temp\asl66iqa.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:2484
- - C:\Users\Admin\AppData\Local\Temp\mx3orqcx.exe
    "C:\Users\Admin\AppData\Local\Temp\mx3orqcx.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
      4⤵
      PID:3264
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3664
- - C:\Users\Admin\AppData\Local\Temp\4ozv261r.exe
    "C:\Users\Admin\AppData\Local\Temp\4ozv261r.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Users\Admin\AppData\Roaming\syshost.exe
      C:\Users\Admin\AppData\Roaming\syshost.exe
      4⤵
      Executes dropped EXE
      PID:3264
- - C:\Users\Admin\AppData\Local\Temp\ShulkerV2_patched.exe
    "C:\Users\Admin\AppData\Local\Temp\ShulkerV2_patched.exe"
    3⤵
    - Executes dropped EXE
    PID:2120

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4516

C:\Users\Admin\AppData\Roaming\ntsvckmr.exe
C:\Users\Admin\AppData\Roaming\ntsvckmr.exe
1⤵
- Executes dropped EXE
PID:4008

C:\Users\Admin\AppData\Roaming\b5fa1457-8da4-46ec-9ef9-9108e7d45ffc\ubgzp.exe
C:\Users\Admin\AppData\Roaming\b5fa1457-8da4-46ec-9ef9-9108e7d45ffc\ubgzp.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Users\Admin\AppData\Roaming\syshost.exe
"C:\Users\Admin\AppData\Roaming\syshost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3960

C:\Users\Admin\AppData\Roaming\synchost.exe
C:\Users\Admin\AppData\Roaming\synchost.exe
1⤵
- Executes dropped EXE
PID:2840

C:\Users\Admin\AppData\Roaming\synchost.exe
C:\Users\Admin\AppData\Roaming\synchost.exe
1⤵
- Executes dropped EXE
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4bd5en95.exe

Path C:\Users\Admin\AppData\Local\Temp\4bd5en95.exe
Size 440KB
SHA256 04ef642ea5f51c774c5f879827f989c5070efd2767c4d7d4022b1111ac6f7a94
MD5 10a320ba7543dcad47f4fef1c330f8c6
SHA1 f9dcd5060a7d57b2b10e54f753af69c649e07bcf
SHA512 66a6c6d671d01e1c1fe4cf1a50518afa675b6b1029534fbacb0ddbc0f5da82fe1474a14ea66ecae3bb4881ed37927969044924af2965306a0b95410ead5358cd
SSDEEP 6144:EWgDaADwKk5dC6iI+KcjRr3lPeriztKjT1UXS+cnhUiAOxDTaVFh3pg:EWgDaADwKH971PerixehRkFh3pg
TLSH
T1A3A45B203857C032D66191B10E7AFFF695ADA8259B3109DBB7D40E779D202D26B31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShulkerV2_patched.exe

Path C:\Users\Admin\AppData\Local\Temp\ShulkerV2_patched.exe
Size 42.7MB
SHA256 e2ee7bbdf623e9f54ddc9b88a29e80dd445bb13505189a8c3ef36137fd6b7a1b
MD5 304a6f605a074bf4e60668de76344fdc
SHA1 6a9b30b75992e46406aaa261515563e66d95dcac
SHA512 46049aaead6d6a8082d8a4f5f46c6740e0fec7cbef6ceb75e8d4b0a896d5ebe665224a30e1c4f4d01ca7b292704c1fbae0e56b5feac2cbf4474293504fc42680
SSDEEP 196608:13kF0bmzrh0EVP/gxsU+1RFtYlHzgrbJ3Fi4s/NGhD3+mZ:10QsRwOQlHzCbJ3Y/NGB+e
TLSH
T1F1A73B6BBC650CE0E4ADC130C522956A7FB13C5A776023D32A58F6183F3EBE415BA758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asl66iqa.exe

Path C:\Users\Admin\AppData\Local\Temp\asl66iqa.exe
Size 10.8MB
SHA256 0aaa2f8155699d1f132dad8dc5b0e031e5326ba516f28a1c9eb4c0dbdb8fd6f9
MD5 7487c7f74e19e6cd758df2032977752e
SHA1 604c47aa0cbf615174136d17eb92ebdf51a0dfe4
SHA512 18134ade854d1aa204bdbdb31a72a6bf7e07d40e239ffe7bd4a3b7165fbe8ba9cbfbf285de07a0e1646c705a2ae59a0fb80c84a1f288384b2883d18650b8fd45
SSDEEP 98304:VAX7ytoKt4xIgfjtkyJ6th1MXp0oRPcr6DJKHl3NK:Uc0tfZkhIpDI6DcHl3N
TLSH
T1B2B60237B28A753EF06E1A365AB2D210943B76616C134D1AD7F448ACCF291A03E3B757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\dia_abe_240749953\Chrome\Default\cookies.json
Size 452B
SHA256 2f960cb618a1ff1dbf6b689a4dbae80371a94358dae3fd259cd4862187353b15
MD5 08783f844a5818130172b6a14749b71f
SHA1 ff80bab20d6ea452610196b99579315253b7136d
SHA512 71b9159dccf35c71f626e9b7768463d544e4562b96382c4bfb7ab01c57d0787eaceb16e7b17f0693d962901a6e45a657af0cc310f6562e8181aebe74fe728649
TLSH
T13FF0DC7A10C59622C86BAF3149027F6E39314B215A9CED9C64478165095DC7092214EF
MD5 SHA1 SHA512 TLSH

Submit Download

dkgaawaf.exe

Path C:\Users\Admin\AppData\Local\Temp\dkgaawaf.exe
Size 160KB
SHA256 e12df0bd8537cd9ac639a5dd907e495170192c015f0c39cd3210eb85c4529099
MD5 61df091cb3190322eac28400b44c787c
SHA1 1d5c9d22dafd9a8a609379a1827cb754538658f2
SHA512 28ae8d985c5f38392936f3c3480c910a4ec9bee6ecf54d47c3474b13ec789b5200c55a3987e433de2fc1dfbd1edb9475eb4c0c190a25e196c26d39ae7bc219f2
SSDEEP 3072:JeY7lWfsMoSc+LsfSxfWINaMOhMce6UMKv2b986:JemlWfwSLsO5a5Mmu
TLSH
T16BF35B4BB3A424F9D17B8239C8951A06F372783247618BEF0764077A5F632D19E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lvm3788j.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-BOKVVMRQWU.tmp\lvm3788j.tmp
Size 4.3MB
SHA256 ad5b5c6f4d8ce692fb75138c1fa5f4a2989ca34165d3557490ec9608dcdae57d
MD5 9a23949f8bec52a24961573265418fe5
SHA1 7ae11131d19b98e210b96ab0f82c3bb43ff5b700
SHA512 ba195b57652c9974f20a2725c041b0497ca7f366eb1ed9e63635dd6c37938ad864d69033e1610c3038080c34f30b16caa361d895fd37c7b0dcb97e578ea362cd
SSDEEP 49152:3oPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lOJ333hmL:3gw26xBij3QG+ddr9/OzGbRwi333hG
TLSH
T194265B13B348653ED4661A3B4837E24E583F7E303E568C4A6AFC3D6C6E356406D2A6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asl66iqa.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-IRFCGNSBMK.tmp\asl66iqa.tmp
Size 4.2MB
SHA256 23d574b45abfa4dc557daab2a46b91c480a3188a4b6521c20b8cb3a9be2bb8bd
MD5 051b6509783a8d892dc8ba487e763ec1
SHA1 73e0712cab4be8103b978cb3073a859a72f3deb6
SHA512 d53c67120807a7f0eeeff09f42b02181f42f55ba289f0e7ca3420b58b0e015488e457d92bb5e8a151d19f87991a43258caf88c762193f8268de4f6a484361e11
SSDEEP 49152:1oPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lOL3338k:1gw26xBij3QG+ddr9/OzGbRwM333j
TLSH
T113166C13B388653AE46B1A3B483BA658583F7F313A168C577BE40D4D4E396407E2A7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-WH3LGE6EZX.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jx7a5byk.exe

Path C:\Users\Admin\AppData\Local\Temp\jx7a5byk.exe
Size 82KB
SHA256 fb6e0d89e365205f243b3c02b76c8bd463e9daf83c465a36d39a3cef04820065
MD5 2c2d3d428bc7d16cf36c5243481c16ca
SHA1 317d121f248c6b696d178b706bc228b1b020545e
SHA512 cd24c442ad323ba1cf36035034fe219f8c7140aa5d52318eab322f81e44b8f9fbbef08667ec41d3cd30e850f9c53bc56a7cc32af19fbb824ef5e898db92825cb
SSDEEP 1536:LM9Fe6tLlVrgNnPxpnycv4TghsgmbGPetiHM5usj3fMZtIvet4yrqUp:Yze6tnrgNnPxFNgTw+sM5u2M7Imlr9p
TLSH
T16383173723D153F9D9A7C232C5B8AE3BD772F0427621434F0262D9591FA36B1BD18A86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lvm3788j.exe

Path C:\Users\Admin\AppData\Local\Temp\lvm3788j.exe
Size 13.7MB
SHA256 546e1ad03a6bbb822882dc9b1faa52bcff457a8c8062a400dbc7ca63087ed108
MD5 b6d558c7315c9626d2eb6d335edca8d1
SHA1 ca2d3e7f2fda22541656fe7d5522d46b3cb5851f
SHA512 afc86a16c1bf1ad73dda3836548db4947c4fb97fdad2c800395715c8d6536a3959e386731955e971a1f9fc40bc911d2405e9eb1e0c055f1398a032f1c01732b0
SSDEEP 98304:iAX7i5wE3GMq11rntsZKEQ20SSZfJxXT8LFAcEbYl3:xYGDfrKZFQ2hgj8B7YA
TLSH
T104E60223A34D167DD06986751A72E21F683F6D316DD28D0D92FC347CFBB6260393A682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mx3orqcx.exe

Path C:\Users\Admin\AppData\Local\Temp\mx3orqcx.exe
Size 2.3MB
SHA256 cb129cd0c0492cf8c1ee11d928bc19163d6e92904721989196ae37fe6607ca19
MD5 93d776420dc5c1aefc035609281762eb
SHA1 a7adcaa1d4dcfbdfb799750d53f661b47b138cca
SHA512 52cd1297faa4bf318b0ec380b2fd8634e3887cfae59e256e404b756768cd2d7c5daf61c5e1b0a5112affad7166c7dc96b36ca8091c15e4cb4a8f8e8f549f6bc8
SSDEEP 49152:eHsI30IOPHO0HKrNEzR2Z3Au/PJvTs6M:wXazRa/54
TLSH
T176B59E4AA3B801FDE0BBC274C9565A07D7B2B8061674D79F13D4479A2F23B716E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ubgzp.exe

Path C:\Users\Admin\AppData\Roaming\b5fa1457-8da4-46ec-9ef9-9108e7d45ffc\ubgzp.exe
Size 82KB
SHA256 a67d2f0a1c268dfe456f73920432ced5b527d5db64ea36846d7b6d6aaa02e57e
MD5 840e9fd56024771058720f9b94730010
SHA1 f8e9c9b9aaca2461572dc72cb0a1003eef3baf31
SHA512 7e8d411bcfe0578ac0fd2ce5187506d065e9344eb0bc5faedce67d737922cdc516a80e3aaecab516db6c5eaf9dc33fb1bc5d3207bc5620fe5d39e0534c8f3061
SSDEEP 1536:LM9Fe6tLlVrgNnPxpnycv4TghsgmbGPetiHM5usj3fMZtIvet4yrqU/:Yze6tnrgNnPxFNgTw+sM5u2M7Imlr9/
TLSH
T17083173723D153F9D9A7C232C5B8AE3BD772F0427621434F0262D9591FA36B1BD18A86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

synchost.exe

Path C:\Users\Admin\AppData\Roaming\synchost.exe
Size 422KB
SHA256 88364b809237dd0f6698322c7361eeff373fff410c46bd55300e2b1047778b4a
MD5 60c0b2c5f67d19ee1929ed2734294678
SHA1 2e7a5a360c5b93b6edf055acc70b276fd7bbdc28
SHA512 706081aefb92017b2b7a0f518d82796e09072b4b1d2b451f120d8c252267a0e112a3caf37681a9c122ce37de6d392afa9922edf83de221f89c1807250a162388
SSDEEP 6144:1WgDaADwKk5dC6iI+KcjRr3lPeriztKjT1UXS+cnhUiAOxDTaVFh3pg:1WgDaADwKH971PerixehRkFh3pg
TLSH
T124945B203857C032D66191B10E7AFFF685ADA8259B7109DBB7D40E779D202D26B31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syshost.exe

Path C:\Users\Admin\AppData\Roaming\syshost.exe
Size 227KB
SHA256 a37f968681c72c8af31a75406225cbfa2bd7596d019ba897671354c77bdbbf34
MD5 7b5efc1602185c198514fcbf1888a397
SHA1 80a582ef22452f0dcdfa6ce3026e678b41bfc053
SHA512 84ab1ce5f7831c736a94646932b6e28a349568afad2ef31aaf9c1d59c23a131a717560baf5e5486552580539f219765529a40604e5170381bbc61d1b21872295
SSDEEP 3072:EenCCJlnP24ywm37p8IRbPM2V4EoGB8TzWqO+IMZvBPJswSMMtdDzzNGucMeDqAw:3CCJde4yw2P/iEcHjO+IMx84xMLn
TLSH
T149346B1B73A508FBE876823DC4535A06D772B8024761CBAF076442AA5F237D1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-129-0x00000000002A0000-0x0000000000703000-memory.dmp

Download

memory/396-133-0x00000000002A0000-0x0000000000703000-memory.dmp

Download

memory/396-164-0x00000000002A0000-0x0000000000703000-memory.dmp

Download

memory/396-125-0x00000000002A0000-0x0000000000703000-memory.dmp

Download

memory/1544-52-0x0000000000DD0000-0x0000000000EB8000-memory.dmp

Download

memory/1544-124-0x0000000000DD0000-0x0000000000EB8000-memory.dmp

Download

memory/1980-31-0x0000000000E00000-0x0000000000F05000-memory.dmp

Download

memory/1980-123-0x0000000000E00000-0x0000000000F05000-memory.dmp

Download

memory/2484-130-0x0000000000250000-0x0000000000696000-memory.dmp

Download

memory/2484-134-0x0000000000250000-0x0000000000696000-memory.dmp

Download

memory/2484-165-0x0000000000250000-0x0000000000696000-memory.dmp

Download

memory/2484-126-0x0000000000250000-0x0000000000696000-memory.dmp

Download

memory/3004-34-0x00000203DD9B0000-0x00000203DD9B2000-memory.dmp

Download

memory/3300-75-0x0000000004770000-0x0000000004771000-memory.dmp

Download

memory/3300-116-0x00000000047A0000-0x00000000047C1000-memory.dmp

Download

memory/3300-117-0x0000000008860000-0x0000000008885000-memory.dmp

Download

memory/3300-119-0x0000000008860000-0x0000000008885000-memory.dmp

Download

memory/3300-36-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/3300-74-0x0000000004760000-0x0000000004761000-memory.dmp

Download

memory/3300-76-0x0000000004780000-0x0000000004781000-memory.dmp

Download

memory/3416-13-0x000002910FF70000-0x000002910FF71000-memory.dmp

Download

memory/3416-14-0x000002910FF80000-0x000002910FF81000-memory.dmp

Download

memory/3416-15-0x000002910FF90000-0x000002910FF91000-memory.dmp

Download

memory/3416-16-0x0000029111950000-0x0000029111951000-memory.dmp

Download

memory/3416-17-0x0000029111960000-0x0000029111961000-memory.dmp

Download