f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd

General

Target

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
Size

268KB
MD5

0dbfc205acc4442b94f2f969263e9106
SHA1

5e5eb551042b385a93a108ce73e3ada9327d7f4a
SHA256

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd
SHA512

d584839c7e875b9d6dc23a2484278a001396d7e932278618a69047f42c9ae8e335b1fde0545a8e1dda6d99370ca4d33871270ee36975b4d1fcb84cccd3668c30
SSDEEP

3072:XCYJYP5dbdH0jBNBTchbjxMy+SgGYftYZdMQw/hXYvtz6wQA/0ipRZOjbZr85Lci:XCmYBdbdQNRYmxb5hktz6w30E6bKJV8O

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\drivers\str.sys	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

Drops file in System32 directory 2 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethost.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
File opened for modification	C:\Windows\SysWOW64\nethost.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exef24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

description	pid	process	target process
PID 2760 set thread context of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 4952 set thread context of 4736	4952	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exef24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exef24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

pid	process
2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
4952	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
4952	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
4952	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
4952	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

description	pid	process
Token: SeDebugPrivilege	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
Token: SeDebugPrivilege	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exef24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe

description	pid	process	target process
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 2760 wrote to memory of 4016	2760	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
PID 4016 wrote to memory of 788	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 788	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 912	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 912	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 968	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 968	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 540	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 540	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 704	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 704	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 664	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 664	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 312	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 312	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1052	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1052	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1128	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1128	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1180	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1180	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1220	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1220	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1272	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1272	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1356	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1356	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1368	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1368	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1440	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1440	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1452	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1452	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1508	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1508	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1608	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1608	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1656	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1656	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1672	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1672	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1680	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1680	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1800	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1800	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1812	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1812	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1912	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1912	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1924	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1924	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1968	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1968	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe
PID 4016 wrote to memory of 1976	4016	f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe	svchost.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2708

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2348

C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
"C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2760

C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
"C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe"
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
"C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe" /runmain
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4952

C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe
"C:\Users\Admin\AppData\Local\Temp\f24108a28d73238047f1d64a4a09138386fdc6bf0062389a31b583c541227fcd.exe" /runmain
5⤵
- Drops file in Drivers directory
PID:4736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\F24108~1.EXE >> NUL
4⤵
PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/728-139-0x0000000000000000-mapping.dmp

Download
memory/2760-134-0x00000000021A0000-0x00000000021C0000-memory.dmp

Filesize
128KB

Download
memory/2760-138-0x00000000021A0000-0x00000000021C0000-memory.dmp

Filesize
128KB

Download
memory/4016-132-0x0000000000000000-mapping.dmp

Download
memory/4016-133-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4016-137-0x0000000000400000-0x0000000000424565-memory.dmp

Filesize
145KB

Download
memory/4736-140-0x0000000000000000-mapping.dmp

Download
memory/4736-143-0x0000000002090000-0x00000000020B3000-memory.dmp

Filesize
140KB

Download
memory/4736-144-0x0000000002060000-0x0000000002071000-memory.dmp

Filesize
68KB

Download
memory/4736-145-0x0000000000400000-0x0000000000424565-memory.dmp

Filesize
145KB

Download
memory/4952-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads