Resubmissions
10-11-2020 01:13
201110-43542766za 1009-11-2020 21:24
201109-1h2689rg6n 1009-11-2020 21:17
201109-txtk4hb582 10Analysis
-
max time kernel
125s -
max time network
115s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 21:17
Static task
static1
Behavioral task
behavioral1
Sample
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
-
Size
660KB
-
MD5
3ba7d3dbc17ce640e0bb3dd5f989169b
-
SHA1
84ee0b6e02339f1deb33d75693551db444923ba8
-
SHA256
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929
-
SHA512
3a683b35dc6b6c17de5a21171625c3fb5259d60c73867aa81b89cedeef61f1b95cce099cc5bb4fdeb2ddf7f2f0236c6d877970768a7f91330ecfbbc38931a231
Malware Config
Extracted
Family
trickbot
Version
100001
Botnet
tar2
C2
66.85.183.5:443
185.163.47.157:443
94.140.115.99:443
195.123.240.40:443
195.123.241.226:443
Attributes
-
autorunName:pwgrab
ecc_pubkey.base64
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org 7 api.ipify.org -
Drops file in System32 directory 1 IoCs
Processes:
wermgr.exedescription ioc Process File created C:\Windows\system32\cn\cgnxqkv.txt wermgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wermgr.execmd.exedescription pid Process Token: SeDebugPrivilege 1084 wermgr.exe Token: SeDebugPrivilege 528 cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exepid Process 2024 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 2024 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe -
Suspicious use of WriteProcessMemory 524 IoCs
Processes:
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exewermgr.exedescription pid Process procid_target PID 2024 wrote to memory of 1084 2024 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 2024 wrote to memory of 1084 2024 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 2024 wrote to memory of 1084 2024 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 2024 wrote to memory of 1084 2024 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 2024 wrote to memory of 1084 2024 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 2024 wrote to memory of 1084 2024 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31 PID 1084 wrote to memory of 528 1084 wermgr.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe"C:\Users\Admin\AppData\Local\Temp\52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:528
-
-