Resubmissions
10-11-2020 01:13
201110-43542766za 1009-11-2020 21:24
201109-1h2689rg6n 1009-11-2020 21:17
201109-txtk4hb582 10Analysis
-
max time kernel
1735s -
max time network
1737s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
10-11-2020 01:13
Static task
static1
Behavioral task
behavioral1
Sample
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
-
Size
660KB
-
MD5
3ba7d3dbc17ce640e0bb3dd5f989169b
-
SHA1
84ee0b6e02339f1deb33d75693551db444923ba8
-
SHA256
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929
-
SHA512
3a683b35dc6b6c17de5a21171625c3fb5259d60c73867aa81b89cedeef61f1b95cce099cc5bb4fdeb2ddf7f2f0236c6d877970768a7f91330ecfbbc38931a231
Malware Config
Extracted
Family
trickbot
Version
100001
Botnet
tar2
C2
66.85.183.5:443
185.163.47.157:443
94.140.115.99:443
195.123.240.40:443
195.123.241.226:443
Attributes
-
autorunName:pwgrab
ecc_pubkey.base64
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 icanhazip.com -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\cn\koumbutiym.txt wermgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1588 wermgr.exe Token: SeDebugPrivilege 1216 cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe -
Suspicious use of WriteProcessMemory 524 IoCs
description pid Process procid_target PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe"C:\Users\Admin\AppData\Local\Temp\52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-