660dc5bbb89e25706a79aae40fb0b3b7cfca1ccf57fcef464c7ce821ca8c677d

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/11/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 681KB
Sample261108-3dadnsvtfs
SHA256 660dc5bbb89e25706a79aae40fb0b3b7cfca1ccf57fcef464c7ce821ca8c677d
MD5 9591855f7ea38c0f8a3a4221101db80f
SHA1 11cb36779b2079092a608a671fa69370d9bafd2b
SHA512 0476629dfc92f88f650988761e3407acf743a36a001120c9451d72595762235cdeda035d774dfc4df2b9c37c74216efb7ff6cc760d745071ad646a400dd03746
SSDEEP 12288:Q7BYI1c9hZOQ1joxPSb3Iu9in2YBd9RVDXtSAyY:yb1cQQCSb4u9inBBdjVBSAl
TLSH
T1D8E46B16A6E501FBD0BAE434C9970A27FE3138640324A5EB53D06A972F677E0773E391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4540	takeown.exe
3604	icacls.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 1 IoCs

pid	Process
2532	Process not Found

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4540	takeown.exe
3604	icacls.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Executes a command shell one-liner 1 TTPs 44 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5044	cmd.exe
4916	cmd.exe
4456	cmd.exe
4012	cmd.exe
2644	cmd.exe
3648	cmd.exe
4516	cmd.exe
2896	cmd.exe
4196	cmd.exe
1444	cmd.exe
4620	cmd.exe
2676	cmd.exe
216	cmd.exe
3768	cmd.exe
3160	cmd.exe
3836	cmd.exe
1680	cmd.exe
4892	cmd.exe
3080	cmd.exe
2972	cmd.exe
4536	cmd.exe
2404	cmd.exe
4344	cmd.exe
3296	cmd.exe
2056	cmd.exe
900	cmd.exe
3504	cmd.exe
5100	cmd.exe
4828	cmd.exe
2324	cmd.exe
1580	cmd.exe
5096	cmd.exe
2140	cmd.exe
32	cmd.exe
2692	cmd.exe
4740	cmd.exe
1832	cmd.exe
2124	cmd.exe
2772	cmd.exe
4792	cmd.exe
5112	cmd.exe
2292	cmd.exe
5012	cmd.exe
4820	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2676	cmd.exe

Kills process with taskkill 43 IoCs

defense_evasion

pid	Process
1100	taskkill.exe
692	taskkill.exe
4292	taskkill.exe
2636	taskkill.exe
1788	taskkill.exe
4128	taskkill.exe
2460	taskkill.exe
4588	taskkill.exe
1624	taskkill.exe
4640	taskkill.exe
220	taskkill.exe
4520	taskkill.exe
1804	taskkill.exe
3944	taskkill.exe
3960	taskkill.exe
1724	taskkill.exe
3568	taskkill.exe
2352	taskkill.exe
1036	taskkill.exe
3048	taskkill.exe
3928	taskkill.exe
3204	taskkill.exe
2652	taskkill.exe
2652	taskkill.exe
376	taskkill.exe
2488	taskkill.exe
3776	taskkill.exe
4348	taskkill.exe
1704	taskkill.exe
4908	taskkill.exe
1984	taskkill.exe
3996	taskkill.exe
4784	taskkill.exe
3640	taskkill.exe
3744	taskkill.exe
3428	taskkill.exe
3488	taskkill.exe
3480	taskkill.exe
2680	taskkill.exe
2076	taskkill.exe
4900	taskkill.exe
4912	taskkill.exe
1124	taskkill.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\ = "AMSI_ComAntivirus Class"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ThreadingModel = "Both"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\ = "OA_ComAntivirus Class"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version\ = "1.0"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version\ = "1.0"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ThreadingModel = "Apartment"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	1704	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeDebugPrivilege	1124	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	2652	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	3996	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	3480	taskkill.exe
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	3944	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	376	taskkill.exe
Token: SeDebugPrivilege	692	taskkill.exe
Token: SeDebugPrivilege	2076	taskkill.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	4588	taskkill.exe
Token: SeDebugPrivilege	1624	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	2352	taskkill.exe
Token: SeDebugPrivilege	3204	taskkill.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeDebugPrivilege	2652	taskkill.exe
Token: SeDebugPrivilege	1036	taskkill.exe
Token: SeDebugPrivilege	3744	taskkill.exe
Token: SeDebugPrivilege	4640	taskkill.exe
Token: SeDebugPrivilege	4292	taskkill.exe
Token: SeDebugPrivilege	3428	taskkill.exe
Token: SeDebugPrivilege	220	taskkill.exe
Token: SeDebugPrivilege	4348	taskkill.exe
Token: SeDebugPrivilege	3488	taskkill.exe
Token: SeTakeOwnershipPrivilege	4540	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 5044	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 5044 wrote to memory of 4520	5044	cmd.exe	91
PID 3172 wrote to memory of 4792	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 4792 wrote to memory of 1704	4792	cmd.exe	93
PID 3172 wrote to memory of 4916	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	94
PID 4916 wrote to memory of 2636	4916	cmd.exe	95
PID 3172 wrote to memory of 5100	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	96
PID 5100 wrote to memory of 4908	5100	cmd.exe	97
PID 3172 wrote to memory of 1680	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	98
PID 1680 wrote to memory of 1124	1680	cmd.exe	99
PID 3172 wrote to memory of 4828	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	100
PID 4828 wrote to memory of 3048	4828	cmd.exe	101
PID 3172 wrote to memory of 4516	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	102
PID 4516 wrote to memory of 2652	4516	cmd.exe	103
PID 3172 wrote to memory of 2324	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	104
PID 2324 wrote to memory of 1984	2324	cmd.exe	105
PID 3172 wrote to memory of 4892	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	106
PID 4892 wrote to memory of 3996	4892	cmd.exe	107
PID 3172 wrote to memory of 4344	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	108
PID 4344 wrote to memory of 1788	4344	cmd.exe	109
PID 3172 wrote to memory of 216	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	110
PID 216 wrote to memory of 3480	216	cmd.exe	111
PID 3172 wrote to memory of 2896	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	112
PID 2896 wrote to memory of 1804	2896	cmd.exe	113
PID 3172 wrote to memory of 1580	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	114
PID 1580 wrote to memory of 1100	1580	cmd.exe	115
PID 3172 wrote to memory of 5112	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	116
PID 5112 wrote to memory of 3944	5112	cmd.exe	117
PID 3172 wrote to memory of 3080	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	118
PID 3080 wrote to memory of 3960	3080	cmd.exe	119
PID 3172 wrote to memory of 4456	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	120
PID 4456 wrote to memory of 2680	4456	cmd.exe	121
PID 3172 wrote to memory of 2972	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	123
PID 2972 wrote to memory of 4784	2972	cmd.exe	124
PID 3172 wrote to memory of 4740	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	126
PID 4740 wrote to memory of 376	4740	cmd.exe	127
PID 3172 wrote to memory of 1832	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	128
PID 1832 wrote to memory of 692	1832	cmd.exe	129
PID 3172 wrote to memory of 2292	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	130
PID 2292 wrote to memory of 2076	2292	cmd.exe	131
PID 3172 wrote to memory of 5096	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	132
PID 5096 wrote to memory of 4900	5096	cmd.exe	133
PID 3172 wrote to memory of 5012	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	134
PID 5012 wrote to memory of 1724	5012	cmd.exe	135
PID 3172 wrote to memory of 3768	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	136
PID 3768 wrote to memory of 3928	3768	cmd.exe	137
PID 3172 wrote to memory of 2124	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	138
PID 2124 wrote to memory of 4128	2124	cmd.exe	139
PID 3172 wrote to memory of 2772	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	140
PID 2772 wrote to memory of 2460	2772	cmd.exe	141
PID 3172 wrote to memory of 3160	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	142
PID 3160 wrote to memory of 3640	3160	cmd.exe	143
PID 3172 wrote to memory of 4012	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	144
PID 4012 wrote to memory of 4588	4012	cmd.exe	145
PID 3172 wrote to memory of 4196	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	146
PID 4196 wrote to memory of 1624	4196	cmd.exe	147
PID 3172 wrote to memory of 3296	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	148
PID 3296 wrote to memory of 2488	3296	cmd.exe	149
PID 3172 wrote to memory of 2644	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	150
PID 2644 wrote to memory of 4912	2644	cmd.exe	151
PID 3172 wrote to memory of 2140	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	152
PID 2140 wrote to memory of 3568	2140	cmd.exe	153
PID 3172 wrote to memory of 2056	3172	2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	154
PID 2056 wrote to memory of 2352	2056	cmd.exe	155

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3136	attrib.exe
944	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im gameoverlayui.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im gameoverlayui.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RadeonSoftware.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RadeonSoftware.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSServ.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSServ.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im amdow.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im amdow.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im AMDRSSrcExt.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im AMDRSSrcExt.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GamePanel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GamePanel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im bcastdvr.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im bcastdvr.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im GameBarFTServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GameBarFTServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RTSS.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RTSS.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MSIAfterburner.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MSIAfterburner.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Medal.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Medal.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MedalEncoder.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MedalEncoder.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MServer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MServer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im squirrel.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im squirrel.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im elevate.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im elevate.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im crashpad_handler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im crashpad_handler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper32.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper32.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im inject-helper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im inject-helper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffmpeg.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffmpeg.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ffprobe.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ffprobe.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mp4info.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mp4info.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ThumbnailGenerator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ThumbnailGenerator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ICYMICreator.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ICYMICreator.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Overwolf.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Overwolf.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncher.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncher.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBrowser.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBrowser.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfHelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfHelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-obs.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-obs.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ow-overlay.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ow-overlay.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfUpdater.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfUpdater.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfCrashHandler.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfCrashHandler.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfBenchmarking.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4820
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfBenchmarking.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWCleanup.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4536
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWCleanup.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstaller.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstaller.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OWUninstallMenu.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2404
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OWUninstallMenu.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OverwolfLauncherProxy.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4620
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OverwolfLauncherProxy.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA App.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:32
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA App.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im "NVIDIA Overlay.exe" /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "NVIDIA Overlay.exe" /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper64.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3504
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper64.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvsphelper.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3648
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvsphelper.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im nvcontainer.exe /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3836
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im nvcontainer.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\SOFTWARE\MyCheat" /f
  2⤵
  PID:5116
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}" /f
  2⤵
  PID:4176
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:1816
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}" /f
  2⤵
  PID:3984
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S "C:\Program Files (x86)\Kaspersky Lab"
  2⤵
  - Views/modifies file attributes
  PID:3136
- C:\Windows\SYSTEM32\attrib.exe
  attrib -H -S -R "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll"
  2⤵
  - Views/modifies file attributes
  PID:944
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll" /grant Administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

office_antivirus.dll

Path C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll
Size 23KB
SHA256 4cc64ce68c8a72ddbf19c9529c978044718154659ce9ae0dc73ab1e8d6227e3b
MD5 7c55fdb6ef4998640f26d70eb81281aa
SHA1 197e83951692c23fdff29a256865468ac8e61051
SHA512 245f494d97c0b024587eaea4102ce868d2dd6c6322219faea1e2d18585321347de21ad4ebe33e3999b2dc792c20f3afa799557a455ae59523ea2e7eecf9c4413
SSDEEP 384:s4ZzQHvX1MshplRXvPKgGthUpH8DZvzZUhCm/Ct:s1PlM0plR/JGtup8lvzZxKs
TLSH
T1B0B27CC2BF5D04E2DAA14674CCE31907FCB7B6E417642AAF026095660ED73D2BF27429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads