lgoogloader | c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004 | Triage

Analysis

max time kernel
138s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2023 08:27

Sharing

Report Analysis Logs

General

Target

c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
Size

695KB
MD5

928fa3e8a43ce4f32e5cb5f469a4981f
SHA1

742c4185e8ef6a8a70b320927d0dbc13a33a7c6f
SHA256

c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004
SHA512

c625374d344ef3c607659e5a4eb0d2978e6d030d25310cc9c9ed4aa249ef9adcf50a2053035c94daa750c8ddef044208c2425e01fe759662c32eff9140e9513c
SSDEEP

12288:8HbpxW0j2LnZvxo1IB5DiQqyGF3S064Fd+smJjMHGT/Ksq/KsK/Ksu:8HbpxW0j2LnboqiV3p/FEZjX7iC+

Score

10^/10

lgoogloader downloader persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3484-142-0x00000000015A0000-0x00000000015AD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Sets service image path in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

description	pid	process	target process
PID 4708 set thread context of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

pid	process
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

pid process

4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

description	pid	process
Token: SeDebugPrivilege	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
Token: SeLoadDriverPrivilege	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
Token: SeDebugPrivilege	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe

description	pid	process	target process
PID 4708 wrote to memory of 2052	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_compiler.exe
PID 4708 wrote to memory of 2052	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_compiler.exe
PID 4708 wrote to memory of 4988	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	AppLaunch.exe
PID 4708 wrote to memory of 4988	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	AppLaunch.exe
PID 4708 wrote to memory of 3568	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	Microsoft.Workflow.Compiler.exe
PID 4708 wrote to memory of 3568	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	Microsoft.Workflow.Compiler.exe
PID 4708 wrote to memory of 2012	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	InstallUtil.exe
PID 4708 wrote to memory of 2012	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	InstallUtil.exe
PID 4708 wrote to memory of 4048	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	EdmGen.exe
PID 4708 wrote to memory of 4048	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	EdmGen.exe
PID 4708 wrote to memory of 3576	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	RegSvcs.exe
PID 4708 wrote to memory of 3576	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	RegSvcs.exe
PID 4708 wrote to memory of 4564	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	csc.exe
PID 4708 wrote to memory of 4564	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	csc.exe
PID 4708 wrote to memory of 3424	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_regbrowsers.exe
PID 4708 wrote to memory of 3424	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_regbrowsers.exe
PID 4708 wrote to memory of 3872	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	ComSvcConfig.exe
PID 4708 wrote to memory of 3872	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	ComSvcConfig.exe
PID 4708 wrote to memory of 4276	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	ilasm.exe
PID 4708 wrote to memory of 4276	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	ilasm.exe
PID 4708 wrote to memory of 3336	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_regsql.exe
PID 4708 wrote to memory of 3336	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_regsql.exe
PID 4708 wrote to memory of 800	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	AddInProcess32.exe
PID 4708 wrote to memory of 800	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	AddInProcess32.exe
PID 4708 wrote to memory of 800	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	AddInProcess32.exe
PID 4708 wrote to memory of 4428	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_regiis.exe
PID 4708 wrote to memory of 4428	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_regiis.exe
PID 4708 wrote to memory of 4320	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	SMSvcHost.exe
PID 4708 wrote to memory of 4320	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	SMSvcHost.exe
PID 4708 wrote to memory of 5028	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	MSBuild.exe
PID 4708 wrote to memory of 5028	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	MSBuild.exe
PID 4708 wrote to memory of 1328	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	ServiceModelReg.exe
PID 4708 wrote to memory of 1328	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	ServiceModelReg.exe
PID 4708 wrote to memory of 2856	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	DataSvcUtil.exe
PID 4708 wrote to memory of 2856	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	DataSvcUtil.exe
PID 4708 wrote to memory of 1972	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	RegAsm.exe
PID 4708 wrote to memory of 1972	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	RegAsm.exe
PID 4708 wrote to memory of 4732	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	cvtres.exe
PID 4708 wrote to memory of 4732	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	cvtres.exe
PID 4708 wrote to memory of 4192	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	ngentask.exe
PID 4708 wrote to memory of 4192	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	ngentask.exe
PID 4708 wrote to memory of 2196	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	dfsvc.exe
PID 4708 wrote to memory of 2196	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	dfsvc.exe
PID 4708 wrote to memory of 4268	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_wp.exe
PID 4708 wrote to memory of 4268	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_wp.exe
PID 4708 wrote to memory of 3428	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	vbc.exe
PID 4708 wrote to memory of 3428	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	vbc.exe
PID 4708 wrote to memory of 4868	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	AddInProcess.exe
PID 4708 wrote to memory of 4868	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	AddInProcess.exe
PID 4708 wrote to memory of 732	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_state.exe
PID 4708 wrote to memory of 732	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	aspnet_state.exe
PID 4708 wrote to memory of 4996	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	mscorsvw.exe
PID 4708 wrote to memory of 4996	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	mscorsvw.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe
PID 4708 wrote to memory of 3484	4708	c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
"C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe"
1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:2052

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
2⤵
PID:4988

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
2⤵
PID:3568

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
2⤵
PID:2012

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
2⤵
PID:4048

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
2⤵
PID:3576

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
2⤵
PID:4564

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
2⤵
PID:3424

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
2⤵
PID:3872

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
2⤵
PID:4276

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
2⤵
PID:3336

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
2⤵
PID:800

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
2⤵
PID:4428

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
2⤵
PID:4320

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
2⤵
PID:5028

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
2⤵
PID:1328

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
2⤵
PID:2856

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
2⤵
PID:1972

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
2⤵
PID:4732

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
2⤵
PID:4192

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
2⤵
PID:2196

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
2⤵
PID:4268

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
2⤵
PID:3428

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
2⤵
PID:4868

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
2⤵
PID:732

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
2⤵
PID:4996

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:3484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3484-136-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3484-137-0x00000000004046C6-mapping.dmp

Download
memory/3484-138-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3484-140-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3484-141-0x0000000001580000-0x0000000001589000-memory.dmp

Filesize
36KB

Download
memory/3484-142-0x00000000015A0000-0x00000000015AD000-memory.dmp

Filesize
52KB

Download
memory/4708-132-0x000001C787620000-0x000001C7876D0000-memory.dmp

Filesize
704KB

Download
memory/4708-133-0x000001C789360000-0x000001C7893D6000-memory.dmp

Filesize
472KB

Download
memory/4708-134-0x000001C7893E0000-0x000001C7893FE000-memory.dmp

Filesize
120KB

Download
memory/4708-135-0x00007FFA96AE0000-0x00007FFA975A1000-memory.dmp

Filesize
10.8MB

Download
memory/4708-139-0x00007FFA96AE0000-0x00007FFA975A1000-memory.dmp

Filesize
10.8MB

Download