xloader | 882adac4b90bbb61698ae0056c7fc82a185f9b3e33f9ebbdb77bb20bcd16d41e

Analysis

max time kernel
153s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
18/02/2022, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INQUIRY 30562-JO.exe
Size 763KB
Sample220218-n87kbscea8
SHA256 882adac4b90bbb61698ae0056c7fc82a185f9b3e33f9ebbdb77bb20bcd16d41e
MD5 8944f1a603b023cd75cca7c3dd13af5a
SHA1 3548c3210a3206d5982fffecf608afbe33693fae
SHA512 7b5e19f5b4c463a99af7dd70f667d8cba90adfcb009eec463b5113d1c1db7c9a5307689cad58a0d039cb4171176996957c2ba8199d6414f1e914610c8a324eb5
MD5 SHA1 SHA512

Score

10^/10

xloader dnqi loader persistence rat

Malware Config

Extracted

Family

xloader

Version

Campaign

dnqi

Decoy

globexglobalstore.com
nanshalife.online
sferastp.com
coastalriskga.com
vintagealiso.com
bremosa.com
dirtymindtees.com
nonsensehenough.com
stakecompare.com
alphablackcars.com
vinawap.mobi
subito-credit.xyz
infowebp.com
boomboombusiness.com
pestancecontrol.xyz
amazingspanishlook.com
nb-xingya.com
bhawanitransports.com
contractor-mart.com
igingood.com
palemonio.com
turnerfamilychildcare.com
bakc.xyz
globalnomadguide.com
cafe21-3.com
visarutravel.com
starfishexuma.com
cachxa.com
vestrahub.com
yahxitv.com
lottomars.com
kcsfoodus.com
casagrandehouses.com
bonicmarket.com
kentuckymowers.com
fegemac.com
dunya.info
fatiresources.com
lololololo.club
webcams5d.art
iphone13pro.guide
deliverydriverclaims.online
gastricrofqyv.xyz
kd16.xyz
oceanofs.com
minjia56.com
hswclient.com
hlthtech.net
autofasil.com
marshviewmedia.com
healinghomescandles.com
houstonafterparties.com
chocodatos.com
satode.com
e-transfer-bill.com
115edinburghway.com
xinshishenghuo.com
elenazhilina.com
gogoma3.com
dripcoffeetime.com
connoisseurcat.com
724akutakviye.com
ohayouwww.com
elnejjarconsulting.com
qtwzdw.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2796-134-0x0000000072480000-0x00000000724A9000-memory.dmp	xloader
behavioral2/memory/2796-136-0x0000000072480000-0x00000000724A9000-memory.dmp	xloader
behavioral2/memory/2600-142-0x0000000005000000-0x0000000005029000-memory.dmp	xloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dmygwfvs = "C:\\Users\\Admin\\svfwgymD.url"	INQUIRY 30562-JO.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 2372	2796	DpiScaling.exe	38
PID 2600 set thread context of 2372	2600	chkdsk.exe	38

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Modifies data under HKEY_USERS 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "8.769037"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4060"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4400"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.685296"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4172"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013144"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132898359249044725"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2796	DpiScaling.exe
2796	DpiScaling.exe
2796	DpiScaling.exe
2796	DpiScaling.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe
2600	chkdsk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2796	DpiScaling.exe
2796	DpiScaling.exe
2796	DpiScaling.exe
2600	chkdsk.exe
2600	chkdsk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeDebugPrivilege	2796	DpiScaling.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe
Token: SeBackupPrivilege	1464	TiWorker.exe
Token: SeRestorePrivilege	1464	TiWorker.exe
Token: SeSecurityPrivilege	1464	TiWorker.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 2796	3524	INQUIRY 30562-JO.exe	74
PID 3524 wrote to memory of 2796	3524	INQUIRY 30562-JO.exe	74
PID 3524 wrote to memory of 2796	3524	INQUIRY 30562-JO.exe	74
PID 3524 wrote to memory of 2796	3524	INQUIRY 30562-JO.exe	74
PID 3524 wrote to memory of 2796	3524	INQUIRY 30562-JO.exe	74
PID 3524 wrote to memory of 2796	3524	INQUIRY 30562-JO.exe	74
PID 2372 wrote to memory of 2600	2372	Explorer.EXE	75
PID 2372 wrote to memory of 2600	2372	Explorer.EXE	75
PID 2372 wrote to memory of 2600	2372	Explorer.EXE	75
PID 2600 wrote to memory of 2680	2600	chkdsk.exe	76
PID 2600 wrote to memory of 2680	2600	chkdsk.exe	76
PID 2600 wrote to memory of 2680	2600	chkdsk.exe	76

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\INQUIRY 30562-JO.exe
  "C:\Users\Admin\AppData\Local\Temp\INQUIRY 30562-JO.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\DpiScaling.exe
    C:\Windows\System32\DpiScaling.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\DpiScaling.exe"
    3⤵
    PID:2680

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:3232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3268

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-140-0x0000000008810000-0x0000000008928000-memory.dmp

Download

memory/2372-145-0x0000000008590000-0x00000000086C3000-memory.dmp

Download

memory/2600-144-0x00000000055D0000-0x0000000005660000-memory.dmp

Download

memory/2600-143-0x00000000057A0000-0x0000000005AEA000-memory.dmp

Download

memory/2600-142-0x0000000005000000-0x0000000005029000-memory.dmp

Download

memory/2600-141-0x0000000000430000-0x000000000043A000-memory.dmp

Download

memory/2796-137-0x0000000004580000-0x00000000048CA000-memory.dmp

Download

memory/2796-135-0x0000000000380000-0x0000000000381000-memory.dmp

Download

memory/2796-139-0x0000000000D30000-0x0000000000D41000-memory.dmp

Download

memory/2796-138-0x000000007249D000-0x000000007249E000-memory.dmp

Download

memory/2796-136-0x0000000072480000-0x00000000724A9000-memory.dmp

Download

memory/2796-134-0x0000000072480000-0x00000000724A9000-memory.dmp

Download

memory/3524-130-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/3524-133-0x00000000039F6000-0x00000000039F7000-memory.dmp

Download