Resubmissions
10/11/2020, 01:13
201110-43542766za1009/11/2020, 21:24
201109-1h2689rg6n1009/11/2020, 21:17
201109-txtk4hb58210Analysis
- max time kernel
1735s - max time network
1737s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 01:13
Static task
static1
Behavioral task
behavioral1
Sample
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe
- Size 660KB
- Sample201110-43542766za
- SHA256 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929
- MD5 3ba7d3dbc17ce640e0bb3dd5f989169b
- SHA1 84ee0b6e02339f1deb33d75693551db444923ba8
- SHA512 3a683b35dc6b6c17de5a21171625c3fb5259d60c73867aa81b89cedeef61f1b95cce099cc5bb4fdeb2ddf7f2f0236c6d877970768a7f91330ecfbbc38931a231
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
trickbot
Version
-
100001
Botnet
-
tar2
C2
-
66.85.183.5:443
-
185.163.47.157:443
-
94.140.115.99:443
-
195.123.240.40:443
-
195.123.241.226:443
Attributes
-
autorunName:pwgrab
ecc_pubkey.base64
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 icanhazip.com - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\cn\koumbutiym.txt wermgr.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1588 wermgr.exe Token: SeDebugPrivilege 1216 cmd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe - Suspicious use of WriteProcessMemory 524 IoCs
description pid Process procid_target PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1056 wrote to memory of 1588 1056 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe 30 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31 PID 1588 wrote to memory of 1216 1588 wermgr.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe"C:\Users\Admin\AppData\Local\Temp\52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-