amadey | 5a5b14dee63553fb7f57baff9759c8a93720fe56e84cef72395913f34729b3d7

Analysis

max time kernel
18s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe
Size 70.5MB
Sample261107-rwpersfb69
SHA256 5a5b14dee63553fb7f57baff9759c8a93720fe56e84cef72395913f34729b3d7
MD5 4dc6b4264577ccae0b00328e37d77984
SHA1 8152990737717184df5493ab316d3e987dfb73bc
SHA512 f9bb51665d6d8dd3383110b80710cba5af9f50ecb015c83d84c28f6795635075ac9ecd0ac4631666416d56e697c9259b6f296a8e6057e2277be193cfc3a49734
SSDEEP 1572864:YuKKUb4L1akqtFUm1mm+KTZhZhXKoWeB3h0RQjE6lEHRqucrc:/KCakqj1h+KdhyViCRJ6OHR
TLSH
T160F73398015FE0B5E5229370C028EB719D03789E971A853F1534688E3BE35BACDDA7DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery downloader execution amadey solaris_loader svcstealer installer loader persistence spyware stealer trojan

Malware Config

Extracted

Family

solaris_loader

Version

193.178.158.57
193.178.158.107
196.251.107.186

Extracted

Family

amadey

Version

5.92

http://193.178.158.107
http://196.251.107.186

Attributes

install_dir
17082f4eef
install_file
Wfeuilcmo.exe
strings_key
51ac028ab14af136529d7c2c3cc0f1b4
url_paths
/Bjsw3DlG1/index.php

/8jdjZhdf7/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
loader solaris_loader
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects Amadey x86-bit Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c546-16.dat	family_amadey_v2
behavioral2/files/0x000d00000001c549-24.dat	family_amadey_v2

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/files/0x000e00000001c542-67.dat	family_svcstealer

Custom signature

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c542-67.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c542-67.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral2/memory/4328-26-0x0000021AB3F30000-0x0000021AB3F32000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/3028-103-0x00000000039F0000-0x0000000003A11000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c542-67.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c56f-112.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c542-67.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Custom signature

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c542-67.dat	INDICATOR_SUSPICIOUS_GENInfoStealer

Custom signature

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c542-67.dat	INDICATOR_SUSPICIOUS_References_SecTools

Custom signature

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c542-67.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 15 IoCs

pid	Process
3752	jx7a5byk.exe
4112	dkgaawaf.exe
2216	4bd5en95.exe
4560	synchost.exe
2764	lvm3788j.exe
5744	lvm3788j.tmp
5724	asl66iqa.exe
2500	msedgeupdateinx.exe
4900	mx3orqcx.exe
5728	4ozv261r.exe
5308	asl66iqa.tmp
3524	syshost.exe
3948	gcbdu.exe
2700	syshost.exe
2264	ShulkerV2_patched.exe

Loads dropped DLL 2 IoCs

pid	Process
5744	lvm3788j.tmp
5308	asl66iqa.tmp

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\msedgeupdateinx.exe"	dkgaawaf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Syshost = "\"C:\\Users\\Admin\\AppData\\Roaming\\syshost.exe\""	4ozv261r.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3752	jx7a5byk.exe
3948	gcbdu.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\synchost.job	synchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5864	cmd.exe
1456	cmd.exe
4280	cmd.exe
4764	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	asl66iqa.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lvm3788j.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lvm3788j.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mx3orqcx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	synchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jx7a5byk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	asl66iqa.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mx3orqcx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jx7a5byk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	synchost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	synchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lvm3788j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asl66iqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lvm3788j.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asl66iqa.tmp

Inno Setup is an open-source installation builder for Windows applications. 8 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c548-39.dat	innosetup
behavioral2/memory/2764-41-0x0000000000060000-0x0000000000165000-memory.dmp	innosetup
behavioral2/files/0x000d00000001c54f-52.dat	innosetup
behavioral2/memory/5724-53-0x0000000000F40000-0x0000000001028000-memory.dmp	innosetup
behavioral2/memory/2764-114-0x0000000000060000-0x0000000000165000-memory.dmp	innosetup
behavioral2/memory/5724-116-0x0000000000F40000-0x0000000001028000-memory.dmp	innosetup
behavioral2/memory/2764-196-0x0000000000060000-0x0000000000165000-memory.dmp	innosetup
behavioral2/memory/5724-198-0x0000000000F40000-0x0000000001028000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3752	jx7a5byk.exe
3752	jx7a5byk.exe
3752	jx7a5byk.exe
3752	jx7a5byk.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe
3948	gcbdu.exe
3948	gcbdu.exe
4900	mx3orqcx.exe
4900	mx3orqcx.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	jx7a5byk.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeDebugPrivilege	3948	gcbdu.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeDebugPrivilege	2700	syshost.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe
Token: SeShutdownPrivilege	3028	explorer.exe
Token: SeCreatePagefilePrivilege	3028	explorer.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3752	4692	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	89
PID 4692 wrote to memory of 4112	4692	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	90
PID 4692 wrote to memory of 2216	4692	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	91
PID 2216 wrote to memory of 4560	2216	4bd5en95.exe	92
PID 3752 wrote to memory of 4328	3752	jx7a5byk.exe	59
PID 3752 wrote to memory of 4388	3752	jx7a5byk.exe	60
PID 3752 wrote to memory of 2408	3752	jx7a5byk.exe	81
PID 3752 wrote to memory of 3028	3752	jx7a5byk.exe	82
PID 4692 wrote to memory of 2764	4692	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	93
PID 3028 wrote to memory of 4244	3028	explorer.exe
PID 3028 wrote to memory of 244	3028	explorer.exe
PID 2764 wrote to memory of 5744	2764	lvm3788j.exe	96
PID 4692 wrote to memory of 5724	4692	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	97
PID 4692 wrote to memory of 4900	4692	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	99
PID 4692 wrote to memory of 5728	4692	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	100
PID 5724 wrote to memory of 5308	5724	asl66iqa.exe	101
PID 5728 wrote to memory of 3524	5728	4ozv261r.exe	102
PID 3028 wrote to memory of 1424	3028	explorer.exe
PID 2700 wrote to memory of 3028	2700	syshost.exe	82
PID 4692 wrote to memory of 2264	4692	2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4328

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4388

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2408
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-07_4dc6b4264577ccae0b00328e37d77984_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\jx7a5byk.exe
      "C:\Users\Admin\AppData\Local\Temp\jx7a5byk.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\dkgaawaf.exe
      "C:\Users\Admin\AppData\Local\Temp\dkgaawaf.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\4bd5en95.exe
      "C:\Users\Admin\AppData\Local\Temp\4bd5en95.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Users\Admin\AppData\Roaming\synchost.exe
        
        "C:\Users\Admin\AppData\Roaming\synchost.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\lvm3788j.exe
      "C:\Users\Admin\AppData\Local\Temp\lvm3788j.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\is-H9WEL00QUB.tmp\lvm3788j.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-H9WEL00QUB.tmp\lvm3788j.tmp" /SL5="$70238,3706437,1005568,C:\Users\Admin\AppData\Local\Temp\lvm3788j.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\asl66iqa.exe
      "C:\Users\Admin\AppData\Local\Temp\asl66iqa.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\is-IVPYAHA0KH.tmp\asl66iqa.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IVPYAHA0KH.tmp\asl66iqa.tmp" /SL5="$A0062,2708255,888832,C:\Users\Admin\AppData\Local\Temp\asl66iqa.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\mx3orqcx.exe
      "C:\Users\Admin\AppData\Local\Temp\mx3orqcx.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4900
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        5⤵
        
        PID:1952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        5⤵
        
        PID:2472
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
        5⤵
        Executes a command shell one-liner
        
        PID:1456
      - C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        6⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\4ozv261r.exe
      "C:\Users\Admin\AppData\Local\Temp\4ozv261r.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:5728
    - - C:\Users\Admin\AppData\Roaming\syshost.exe
        
        C:\Users\Admin\AppData\Roaming\syshost.exe
        5⤵
        Executes dropped EXE
        
        PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\ShulkerV2_patched.exe
      "C:\Users\Admin\AppData\Local\Temp\ShulkerV2_patched.exe"
      4⤵
      Executes dropped EXE
      PID:2264
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /d /c start /b "" "C:\Users\Admin\AppData\Local\Temp\lyi27acx.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5864
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /d /c start /b "" "C:\Users\Admin\AppData\Local\Temp\y343dtn1.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4280
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /d /c start /b "" "C:\Users\Admin\AppData\Local\Temp\55irhyg8.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4764

C:\Users\Admin\AppData\Roaming\msedgeupdateinx.exe
C:\Users\Admin\AppData\Roaming\msedgeupdateinx.exe
1⤵
- Executes dropped EXE
PID:2500

C:\Users\Admin\AppData\Roaming\3c5173b8-14e3-4cd2-bd77-4a6d9d7d7942\gcbdu.exe
C:\Users\Admin\AppData\Roaming\3c5173b8-14e3-4cd2-bd77-4a6d9d7d7942\gcbdu.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Users\Admin\AppData\Roaming\syshost.exe
"C:\Users\Admin\AppData\Roaming\syshost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3624

C:\Users\Admin\AppData\Roaming\synchost.exe
"C:\Users\Admin\AppData\Roaming\synchost.exe"
1⤵
PID:5640

C:\Users\Admin\AppData\Roaming\synchost.exe
"C:\Users\Admin\AppData\Roaming\synchost.exe"
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

06052B6007E444CE94DE.exe

Path C:\Users\Admin\AppData\Local\Temp\06052B6007E444CE94DE.exe
Size 24KB
SHA256 642eebe3044f87e973ab336a8ff925ec1c2113d726fab526068a34d2f954c65e
MD5 e9fa39bded724da092004201d8f41a8a
SHA1 151f6c8c44b37182b559cf8b2ae28eacb8a2eb09
SHA512 9b5165645908936ff39b14a600109199b67159906e7e75f590f2b1686f48c6b3c401fddbf53988c9818dbf40286860809da931073cc1731395592d9dfebcab22
SSDEEP 384:D40+BGDP/Rg4wsx99Pt7UNxyGarY4pP1Rl/X1fjbq1+Z1FrzxAqJY:D4lEO4nD74G3pPZFXq1+Z1AqO
TLSH
T11CB23A179346D977C57E833601FA992ABA770A3035134DB2DBE884750A985907C3BACE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c743484d6fc9040b_syshost_loader.exe

Path C:\Users\Admin\AppData\Local\Temp\10000290101\c743484d6fc9040b_syshost_loader.exe
Size 32KB
SHA256 8797df8a8485fcd5435b48c964105c052321efa01c988a750b84c8b735fa927e
MD5 76b1bd8c00b3c1933aed3640f868a785
SHA1 96c334f2fad3f04c329c13d9b9a878ce11c4d38a
SHA512 dbaa2536bf18b6096eb2ca62f08046c53660a0d841cf4648d29c104323c68d492d257f7561acb7294523f4fde9c04bc9799f42ae4bfde76ad3b57293dcb4fe5f
SSDEEP 768:MxI2pcjSe+yXS/IaH+E78FMA8mFxbhPb9yMuhwPc:g7e+y0A6nCJlAcPc
TLSH
T13AE25C6D27A510B8E62A91B9CA81490AD37230524735E7CF077487FB2F73BB2653E352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bd5en95.exe

Path C:\Users\Admin\AppData\Local\Temp\4bd5en95.exe
Size 440KB
SHA256 04ef642ea5f51c774c5f879827f989c5070efd2767c4d7d4022b1111ac6f7a94
MD5 10a320ba7543dcad47f4fef1c330f8c6
SHA1 f9dcd5060a7d57b2b10e54f753af69c649e07bcf
SHA512 66a6c6d671d01e1c1fe4cf1a50518afa675b6b1029534fbacb0ddbc0f5da82fe1474a14ea66ecae3bb4881ed37927969044924af2965306a0b95410ead5358cd
SSDEEP 6144:EWgDaADwKk5dC6iI+KcjRr3lPeriztKjT1UXS+cnhUiAOxDTaVFh3pg:EWgDaADwKH971PerixehRkFh3pg
TLSH
T1A3A45B203857C032D66191B10E7AFFF695ADA8259B3109DBB7D40E779D202D26B31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ozv261r.exe

Path C:\Users\Admin\AppData\Local\Temp\4ozv261r.exe
Size 227KB
SHA256 a37f968681c72c8af31a75406225cbfa2bd7596d019ba897671354c77bdbbf34
MD5 7b5efc1602185c198514fcbf1888a397
SHA1 80a582ef22452f0dcdfa6ce3026e678b41bfc053
SHA512 84ab1ce5f7831c736a94646932b6e28a349568afad2ef31aaf9c1d59c23a131a717560baf5e5486552580539f219765529a40604e5170381bbc61d1b21872295
SSDEEP 3072:EenCCJlnP24ywm37p8IRbPM2V4EoGB8TzWqO+IMZvBPJswSMMtdDzzNGucMeDqAw:3CCJde4yw2P/iEcHjO+IMx84xMLn
TLSH
T149346B1B73A508FBE876823DC4535A06D772B8024761CBAF076442AA5F237D1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55irhyg8.exe

Path C:\Users\Admin\AppData\Local\Temp\55irhyg8.exe
Size 35KB
SHA256 196425f61e2303772f5379bdc7df368345cc2c3cabc6957d74b3a7cb530dca68
MD5 9e0b0a407744604fb7f314f77f585be6
SHA1 23d16947be6284c6c051318f6a59cf705ee57b0b
SHA512 39a22bd9fd55bfc421c8e0720b50e13aa91070fd1dcc20365fccd8c3f234a1f0f3ee4306956a0011f06be7b575036c441b53beaf6e03f318b4224465da83c1ca
SSDEEP 768:MxI2pcjSe+yXS/IaH+E78FMA8mFxbhPb9yMuhwP8Uup1:g7e+y0A6nCJlAcP8pp1
TLSH
T1B5F25C6D27A500B9E62B91B9CA81990AD37270124735E38F077487FB2F73BB2653E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShulkerV2_patched.exe

Path C:\Users\Admin\AppData\Local\Temp\ShulkerV2_patched.exe
Size 42.7MB
SHA256 e2ee7bbdf623e9f54ddc9b88a29e80dd445bb13505189a8c3ef36137fd6b7a1b
MD5 304a6f605a074bf4e60668de76344fdc
SHA1 6a9b30b75992e46406aaa261515563e66d95dcac
SHA512 46049aaead6d6a8082d8a4f5f46c6740e0fec7cbef6ceb75e8d4b0a896d5ebe665224a30e1c4f4d01ca7b292704c1fbae0e56b5feac2cbf4474293504fc42680
SSDEEP 196608:13kF0bmzrh0EVP/gxsU+1RFtYlHzgrbJ3Fi4s/NGhD3+mZ:10QsRwOQlHzCbJ3Y/NGB+e
TLSH
T1F1A73B6BBC650CE0E4ADC130C522956A7FB13C5A776023D32A58F6183F3EBE415BA758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asl66iqa.exe

Path C:\Users\Admin\AppData\Local\Temp\asl66iqa.exe
Size 10.8MB
SHA256 0aaa2f8155699d1f132dad8dc5b0e031e5326ba516f28a1c9eb4c0dbdb8fd6f9
MD5 7487c7f74e19e6cd758df2032977752e
SHA1 604c47aa0cbf615174136d17eb92ebdf51a0dfe4
SHA512 18134ade854d1aa204bdbdb31a72a6bf7e07d40e239ffe7bd4a3b7165fbe8ba9cbfbf285de07a0e1646c705a2ae59a0fb80c84a1f288384b2883d18650b8fd45
SSDEEP 98304:VAX7ytoKt4xIgfjtkyJ6th1MXp0oRPcr6DJKHl3NK:Uc0tfZkhIpDI6DcHl3N
TLSH
T1B2B60237B28A753EF06E1A365AB2D210943B76616C134D1AD7F448ACCF291A03E3B757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dkgaawaf.exe

Path C:\Users\Admin\AppData\Local\Temp\dkgaawaf.exe
Size 160KB
SHA256 e12df0bd8537cd9ac639a5dd907e495170192c015f0c39cd3210eb85c4529099
MD5 61df091cb3190322eac28400b44c787c
SHA1 1d5c9d22dafd9a8a609379a1827cb754538658f2
SHA512 28ae8d985c5f38392936f3c3480c910a4ec9bee6ecf54d47c3474b13ec789b5200c55a3987e433de2fc1dfbd1edb9475eb4c0c190a25e196c26d39ae7bc219f2
SSDEEP 3072:JeY7lWfsMoSc+LsfSxfWINaMOhMce6UMKv2b986:JemlWfwSLsO5a5Mmu
TLSH
T16BF35B4BB3A424F9D17B8239C8951A06F372783247618BEF0764077A5F632D19E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lvm3788j.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-H9WEL00QUB.tmp\lvm3788j.tmp
Size 4.3MB
SHA256 ad5b5c6f4d8ce692fb75138c1fa5f4a2989ca34165d3557490ec9608dcdae57d
MD5 9a23949f8bec52a24961573265418fe5
SHA1 7ae11131d19b98e210b96ab0f82c3bb43ff5b700
SHA512 ba195b57652c9974f20a2725c041b0497ca7f366eb1ed9e63635dd6c37938ad864d69033e1610c3038080c34f30b16caa361d895fd37c7b0dcb97e578ea362cd
SSDEEP 49152:3oPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lOJ333hmL:3gw26xBij3QG+ddr9/OzGbRwi333hG
TLSH
T194265B13B348653ED4661A3B4837E24E583F7E303E568C4A6AFC3D6C6E356406D2A6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asl66iqa.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-IVPYAHA0KH.tmp\asl66iqa.tmp
Size 4.2MB
SHA256 23d574b45abfa4dc557daab2a46b91c480a3188a4b6521c20b8cb3a9be2bb8bd
MD5 051b6509783a8d892dc8ba487e763ec1
SHA1 73e0712cab4be8103b978cb3073a859a72f3deb6
SHA512 d53c67120807a7f0eeeff09f42b02181f42f55ba289f0e7ca3420b58b0e015488e457d92bb5e8a151d19f87991a43258caf88c762193f8268de4f6a484361e11
SSDEEP 49152:1oPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lOL3338k:1gw26xBij3QG+ddr9/OzGbRwM333j
TLSH
T113166C13B388653AE46B1A3B483BA658583F7F313A168C577BE40D4D4E396407E2A7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-S9Q1UDAAQN.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jx7a5byk.exe

Path C:\Users\Admin\AppData\Local\Temp\jx7a5byk.exe
Size 82KB
SHA256 fb6e0d89e365205f243b3c02b76c8bd463e9daf83c465a36d39a3cef04820065
MD5 2c2d3d428bc7d16cf36c5243481c16ca
SHA1 317d121f248c6b696d178b706bc228b1b020545e
SHA512 cd24c442ad323ba1cf36035034fe219f8c7140aa5d52318eab322f81e44b8f9fbbef08667ec41d3cd30e850f9c53bc56a7cc32af19fbb824ef5e898db92825cb
SSDEEP 1536:LM9Fe6tLlVrgNnPxpnycv4TghsgmbGPetiHM5usj3fMZtIvet4yrqUp:Yze6tnrgNnPxFNgTw+sM5u2M7Imlr9p
TLSH
T16383173723D153F9D9A7C232C5B8AE3BD772F0427621434F0262D9591FA36B1BD18A86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lvm3788j.exe

Path C:\Users\Admin\AppData\Local\Temp\lvm3788j.exe
Size 13.7MB
SHA256 546e1ad03a6bbb822882dc9b1faa52bcff457a8c8062a400dbc7ca63087ed108
MD5 b6d558c7315c9626d2eb6d335edca8d1
SHA1 ca2d3e7f2fda22541656fe7d5522d46b3cb5851f
SHA512 afc86a16c1bf1ad73dda3836548db4947c4fb97fdad2c800395715c8d6536a3959e386731955e971a1f9fc40bc911d2405e9eb1e0c055f1398a032f1c01732b0
SSDEEP 98304:iAX7i5wE3GMq11rntsZKEQ20SSZfJxXT8LFAcEbYl3:xYGDfrKZFQ2hgj8B7YA
TLSH
T104E60223A34D167DD06986751A72E21F683F6D316DD28D0D92FC347CFBB6260393A682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lyi27acx.exe

Path C:\Users\Admin\AppData\Local\Temp\lyi27acx.exe
Size 35KB
SHA256 f31ca430598b858edeb6fb3a11f4cbd6a69e6dd5e84e5f7b4eb4f1159957460b
MD5 c3d9652a93b10088190eca0ac79b10ef
SHA1 31dd585bd5cafb3836db022e60ae1baec0645ed3
SHA512 e1796ccabe30c985a8174e3a93eb6729485cdbe9a10e4dfe2c0d2b723cbabff4a42ccc575750f0b205a249bd02a192f368d23530d4ab412e0ef212701fd69b7d
SSDEEP 768:5XEA11heYDKGZJf/WfHMME3skSc6l/HJFc8u:68eYKGZ5/WfsMoScIc5
TLSH
T1BBF24B0E539520FDD22F91B9EA8A6542E276B806470196EF47B44F770F33AE1393E781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mx3orqcx.exe

Path C:\Users\Admin\AppData\Local\Temp\mx3orqcx.exe
Size 2.3MB
SHA256 cb129cd0c0492cf8c1ee11d928bc19163d6e92904721989196ae37fe6607ca19
MD5 93d776420dc5c1aefc035609281762eb
SHA1 a7adcaa1d4dcfbdfb799750d53f661b47b138cca
SHA512 52cd1297faa4bf318b0ec380b2fd8634e3887cfae59e256e404b756768cd2d7c5daf61c5e1b0a5112affad7166c7dc96b36ca8091c15e4cb4a8f8e8f549f6bc8
SSDEEP 49152:eHsI30IOPHO0HKrNEzR2Z3Au/PJvTs6M:wXazRa/54
TLSH
T176B59E4AA3B801FDE0BBC274C9565A07D7B2B8061674D79F13D4479A2F23B716E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y343dtn1.exe

Path C:\Users\Admin\AppData\Local\Temp\y343dtn1.exe
Size 35KB
SHA256 1982878ae4703a30e7f488238bc1ce854b93cbaddb5900689d67309dd6746865
MD5 9b7a7ac6483440fd06d034c60a2699fb
SHA1 5ed702cc3becd4dec3b996bcd8c6bfffae866034
SHA512 b79ea5d4fa4a69cdb2daef3b9e2d9ebc91d066ddb934fa459705f9615444ea4fe71fb20d0a0d5a1287745d687a36e8247b888337e2d27211c0d0e3e2e4c55823
SSDEEP 768:D4lEO4nD74G3pPZFXq1+Z1Aqc0zsGTeks6o0dO+vIXDC:DSx4nD0GLFngj0zBC/XDC
TLSH
T108F27C13D347C577C53E873644A6952AF9BB1A2035271DF3DBE888291E9C6807C2B6CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcbdu.exe

Path C:\Users\Admin\AppData\Roaming\3c5173b8-14e3-4cd2-bd77-4a6d9d7d7942\gcbdu.exe
Size 82KB
SHA256 14434b40b099397ad82964f67e35fe933630e98d07aa68ea6df4d4ad68a08a0d
MD5 58ce7f67ab048828c583f541701d04bc
SHA1 f4ff40c376d26b9176aca64e3bdaa7a4d12d07d3
SHA512 c16eb049243a0c7e576beb198f2ef77a5eb1ae51a49c6e63ee041872e2772d91a993fd8532bdd9f1f3451c6a5fba0d5925ed2378216523eddbf30b53c4729638
SSDEEP 1536:LM9Fe6tLlVrgNnPxpnycv4TghsgmbGPetiHM5usj3fMZtIvet4yrqUj:Yze6tnrgNnPxFNgTw+sM5u2M7Imlr9j
TLSH
T19983173723D153F9D9A7C232C5B8AE3BD772F0427621434F0262D9591FA36B1BD18A86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

synchost.exe

Path C:\Users\Admin\AppData\Roaming\synchost.exe
Size 422KB
SHA256 88364b809237dd0f6698322c7361eeff373fff410c46bd55300e2b1047778b4a
MD5 60c0b2c5f67d19ee1929ed2734294678
SHA1 2e7a5a360c5b93b6edf055acc70b276fd7bbdc28
SHA512 706081aefb92017b2b7a0f518d82796e09072b4b1d2b451f120d8c252267a0e112a3caf37681a9c122ce37de6d392afa9922edf83de221f89c1807250a162388
SSDEEP 6144:1WgDaADwKk5dC6iI+KcjRr3lPeriztKjT1UXS+cnhUiAOxDTaVFh3pg:1WgDaADwKH971PerixehRkFh3pg
TLSH
T124945B203857C032D66191B10E7AFFF685ADA8259B7109DBB7D40E779D202D26B31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2764-41-0x0000000000060000-0x0000000000165000-memory.dmp

Download

memory/2764-114-0x0000000000060000-0x0000000000165000-memory.dmp

Download

memory/2764-196-0x0000000000060000-0x0000000000165000-memory.dmp

Download

memory/3028-46-0x00000000012E0000-0x00000000012E1000-memory.dmp

Download

memory/3028-47-0x00000000012F0000-0x00000000012F1000-memory.dmp

Download

memory/3028-30-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/3028-96-0x0000000001310000-0x0000000001311000-memory.dmp

Download

memory/3028-106-0x0000000003B20000-0x0000000003B45000-memory.dmp

Download

memory/3028-104-0x0000000003B20000-0x0000000003B45000-memory.dmp

Download

memory/3028-103-0x00000000039F0000-0x0000000003A11000-memory.dmp

Download

memory/3752-10-0x00000281CC500000-0x00000281CC501000-memory.dmp

Download

memory/3752-13-0x00000281CDEB0000-0x00000281CDEB1000-memory.dmp

Download

memory/3752-14-0x00000281CDEC0000-0x00000281CDEC1000-memory.dmp

Download

memory/3752-12-0x00000281CDEA0000-0x00000281CDEA1000-memory.dmp

Download

memory/3752-11-0x00000281CDE90000-0x00000281CDE91000-memory.dmp

Download

memory/4328-26-0x0000021AB3F30000-0x0000021AB3F32000-memory.dmp

Download

memory/5308-125-0x0000000000340000-0x0000000000786000-memory.dmp

Download

memory/5308-129-0x0000000000340000-0x0000000000786000-memory.dmp

Download

memory/5308-197-0x0000000000340000-0x0000000000786000-memory.dmp

Download

memory/5308-117-0x0000000000340000-0x0000000000786000-memory.dmp

Download

memory/5724-53-0x0000000000F40000-0x0000000001028000-memory.dmp

Download

memory/5724-116-0x0000000000F40000-0x0000000001028000-memory.dmp

Download

memory/5724-198-0x0000000000F40000-0x0000000001028000-memory.dmp

Download

memory/5744-127-0x0000000000030000-0x0000000000493000-memory.dmp

Download

memory/5744-123-0x0000000000030000-0x0000000000493000-memory.dmp

Download

memory/5744-115-0x0000000000030000-0x0000000000493000-memory.dmp

Download

memory/5744-195-0x0000000000030000-0x0000000000493000-memory.dmp

Download