xloader | c0a5470477f1ef65286a66e14b46c02b71c41eabc473b9885fbe7911844d90b7

General

Target

Purchase Order FEB22_76543.exe
Size

600KB
MD5

939ab865c8b7be3fdfaf765139a62f02
SHA1

fbe936019b2596e65ff25cb46abdb0f48fa93464
SHA256

c0a5470477f1ef65286a66e14b46c02b71c41eabc473b9885fbe7911844d90b7
SHA512

cf170932a7a1f57ea6e8e708bb28ec5c2487a40215b777a9cf6f653ebf3d75f32e95d00991de25d013fc3c7faa8ce5b13fbdbaeb12b8e752d808107e7695f763

Score

10^/10

xloader zqzw loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

zqzw

Decoy

laurentmathieu.com

nohohonndana.com

hhmc.info

shophallows.com

blazebunk.com

goodbridge.xyz

flakycloud.com

bakermckenziegroups.com

formation-adistance.com

lovingearthbotanicals.com

tbrservice.plus

heritagehousehotels.com

drwbuildersco.com

lacsghb.com

wain3x.com

dadreview.club

continiutycp.com

cockgirls.com

48mpt.xyz

033skz.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3164-137-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3164-139-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2500-146-0x0000000002840000-0x0000000002869000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

Purchase Order FEB22_76543.exePurchase Order FEB22_76543.execmstp.exe

description	pid	process	target process
PID 3572 set thread context of 3164	3572	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 3164 set thread context of 2456	3164	Purchase Order FEB22_76543.exe	Explorer.EXE
PID 2500 set thread context of 2456	2500	cmstp.exe	Explorer.EXE

Drops file in Windows directory 3 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132898169671150542"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4120"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.019732"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.734289"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "9.373860"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4340"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3948"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

Purchase Order FEB22_76543.exePurchase Order FEB22_76543.execmstp.exe

pid	process
3572	Purchase Order FEB22_76543.exe
3572	Purchase Order FEB22_76543.exe
3164	Purchase Order FEB22_76543.exe
3164	Purchase Order FEB22_76543.exe
3164	Purchase Order FEB22_76543.exe
3164	Purchase Order FEB22_76543.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe
2500	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2456 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Purchase Order FEB22_76543.execmstp.exe

pid process

3164 Purchase Order FEB22_76543.exe
3164 Purchase Order FEB22_76543.exe
3164 Purchase Order FEB22_76543.exe
2500 cmstp.exe
2500 cmstp.exe

pid	process
2456	Explorer.EXE

pid	process
3164	Purchase Order FEB22_76543.exe
3164	Purchase Order FEB22_76543.exe
3164	Purchase Order FEB22_76543.exe
2500	cmstp.exe
2500	cmstp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

TiWorker.exe

description	pid	process
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe
Token: SeRestorePrivilege	3012	TiWorker.exe
Token: SeSecurityPrivilege	3012	TiWorker.exe
Token: SeBackupPrivilege	3012	TiWorker.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Purchase Order FEB22_76543.exeExplorer.EXEcmstp.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2456

C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3572

C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe
"{path}"
3⤵
PID:2568

C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3164

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe"
3⤵
PID:912

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:8

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2456-143-0x0000000008EF0000-0x0000000008FF4000-memory.dmp

Filesize
1.0MB

Download
memory/2456-148-0x0000000008B60000-0x0000000008CA8000-memory.dmp

Filesize
1.3MB

Download
memory/2500-147-0x0000000004660000-0x00000000046F0000-memory.dmp

Filesize
576KB

Download
memory/2500-146-0x0000000002840000-0x0000000002869000-memory.dmp

Filesize
164KB

Download
memory/2500-145-0x0000000004730000-0x0000000004A7A000-memory.dmp

Filesize
3.3MB

Download
memory/2500-144-0x00000000003D0000-0x00000000003E6000-memory.dmp

Filesize
88KB

Download
memory/3164-139-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3164-137-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3164-140-0x00000000017D0000-0x0000000001B1A000-memory.dmp

Filesize
3.3MB

Download
memory/3164-141-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/3164-142-0x0000000001C30000-0x0000000001C41000-memory.dmp

Filesize
68KB

Download
memory/3572-130-0x000000007536E000-0x000000007536F000-memory.dmp

Filesize
4KB

Download
memory/3572-136-0x0000000004AC0000-0x0000000004ACA000-memory.dmp

Filesize
40KB

Download
memory/3572-135-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/3572-134-0x0000000004BC0000-0x0000000004C5C000-memory.dmp

Filesize
624KB

Download
memory/3572-133-0x0000000004B20000-0x0000000004BB2000-memory.dmp

Filesize
584KB

Download
memory/3572-132-0x00000000050D0000-0x0000000005674000-memory.dmp

Filesize
5.6MB

Download
memory/3572-131-0x0000000000090000-0x000000000012C000-memory.dmp

Filesize
624KB

Download

description	pid	process	target process
PID 3572 wrote to memory of 2568	3572	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 3572 wrote to memory of 2568	3572	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 3572 wrote to memory of 2568	3572	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 3572 wrote to memory of 3164	3572	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 3572 wrote to memory of 3164	3572	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 3572 wrote to memory of 3164	3572	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 3572 wrote to memory of 3164	3572	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 3572 wrote to memory of 3164	3572	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 3572 wrote to memory of 3164	3572	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 2456 wrote to memory of 2500	2456	Explorer.EXE	cmstp.exe
PID 2456 wrote to memory of 2500	2456	Explorer.EXE	cmstp.exe
PID 2456 wrote to memory of 2500	2456	Explorer.EXE	cmstp.exe
PID 2500 wrote to memory of 912	2500	cmstp.exe	cmd.exe
PID 2500 wrote to memory of 912	2500	cmstp.exe	cmd.exe
PID 2500 wrote to memory of 912	2500	cmstp.exe	cmd.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads