Analysis Overview
SHA256
b9b0ce10496a723998fd40bd2662d231e6135c465000d319b708736570d0bd09
Threat Level: Known bad
The file dfw32m3 was found to be: Known bad.
Malicious Activity Summary
Xloader
Xloader payload
Checks computer location settings
Deletes itself
Suspicious use of SetThreadContext
Unsigned PE
Enumerates physical storage devices
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of UnmapMainImage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-01 19:04
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-01 19:04
Reported
2024-04-01 19:07
Platform
win7-20240221-en
Max time kernel
154s
Max time network
126s
Command Line
Signatures
Xloader
Xloader payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3048 set thread context of 2296 | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe |
| PID 2296 set thread context of 1260 | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | C:\Windows\Explorer.EXE |
| PID 2884 set thread context of 1260 | N/A | C:\Windows\SysWOW64\cmd.exe | C:\Windows\Explorer.EXE |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe
"C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NovwaoBFfnCGA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5ABD.tmp"
C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe
"C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
Network
Files
memory/3048-0-0x00000000001B0000-0x000000000025E000-memory.dmp
memory/3048-1-0x0000000074D00000-0x00000000753EE000-memory.dmp
memory/3048-2-0x0000000004E60000-0x0000000004EA0000-memory.dmp
memory/3048-3-0x0000000000410000-0x0000000000428000-memory.dmp
memory/3048-4-0x0000000074D00000-0x00000000753EE000-memory.dmp
memory/3048-5-0x0000000004E60000-0x0000000004EA0000-memory.dmp
memory/3048-6-0x0000000004DD0000-0x0000000004E36000-memory.dmp
memory/2296-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2296-14-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2296-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2296-18-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3048-19-0x0000000074D00000-0x00000000753EE000-memory.dmp
memory/2296-20-0x0000000000960000-0x0000000000C63000-memory.dmp
memory/2296-22-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1260-24-0x00000000036D0000-0x00000000037D0000-memory.dmp
memory/2296-23-0x0000000000280000-0x0000000000291000-memory.dmp
memory/1260-25-0x0000000006D30000-0x0000000006ED6000-memory.dmp
memory/2884-26-0x000000004A520000-0x000000004A56C000-memory.dmp
memory/2884-27-0x000000004A520000-0x000000004A56C000-memory.dmp
memory/2884-28-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/2884-29-0x00000000020A0000-0x00000000023A3000-memory.dmp
memory/2884-30-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/2884-32-0x0000000001F70000-0x0000000002000000-memory.dmp
memory/1260-33-0x0000000006D30000-0x0000000006ED6000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-01 19:04
Reported
2024-04-01 19:07
Platform
win10-20240221-en
Max time kernel
149s
Max time network
157s
Command Line
Signatures
Xloader
Xloader payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2256 set thread context of 2396 | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe |
| PID 2396 set thread context of 3356 | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | C:\Windows\Explorer.EXE |
| PID 1796 set thread context of 3356 | N/A | C:\Windows\SysWOW64\cmmon32.exe | C:\Windows\Explorer.EXE |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmmon32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmmon32.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\cmmon32.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe
"C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NovwaoBFfnCGA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9CA8.tmp"
C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe
"C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
Network
| Country | Destination | Domain | Proto |
| US | 20.231.121.79:80 | tcp | |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.25922727.com | udp |
| US | 8.8.8.8:53 | www.molrik.space | udp |
| US | 8.8.8.8:53 | www.ruiz-group.com | udp |
| US | 3.33.130.190:80 | www.ruiz-group.com | tcp |
| US | 8.8.8.8:53 | 190.130.33.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.28686ay.com | udp |
| US | 8.8.8.8:53 | www.hausense.quest | udp |
| US | 8.8.8.8:53 | www.aodesai.store | udp |
| US | 8.8.8.8:53 | www.drtht.com | udp |
| US | 52.20.84.62:80 | www.drtht.com | tcp |
| US | 8.8.8.8:53 | 62.84.20.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.noblenimble.com | udp |
| US | 52.20.84.62:80 | www.noblenimble.com | tcp |
| US | 8.8.8.8:53 | www.texasdominionrealty.com | udp |
| US | 8.8.8.8:53 | www.digitaltradezone.com | udp |
| US | 162.0.209.119:80 | www.digitaltradezone.com | tcp |
| US | 8.8.8.8:53 | 119.209.0.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.asnntio.xyz | udp |
Files
memory/2256-0-0x0000000000070000-0x000000000011E000-memory.dmp
memory/2256-1-0x0000000073B70000-0x000000007425E000-memory.dmp
memory/2256-2-0x0000000004E60000-0x000000000535E000-memory.dmp
memory/2256-3-0x0000000004960000-0x00000000049F2000-memory.dmp
memory/2256-4-0x0000000004A70000-0x0000000004A80000-memory.dmp
memory/2256-5-0x0000000004A10000-0x0000000004A1A000-memory.dmp
memory/2256-6-0x0000000004D10000-0x0000000004D28000-memory.dmp
memory/2256-7-0x0000000073B70000-0x000000007425E000-memory.dmp
memory/2256-8-0x0000000004A70000-0x0000000004A80000-memory.dmp
memory/2256-9-0x0000000006510000-0x00000000065AC000-memory.dmp
memory/2256-10-0x0000000006740000-0x00000000067A6000-memory.dmp
memory/2396-16-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2256-18-0x0000000073B70000-0x000000007425E000-memory.dmp
memory/2396-19-0x00000000018A0000-0x0000000001BC0000-memory.dmp
memory/2396-22-0x0000000001830000-0x0000000001841000-memory.dmp
memory/2396-21-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3356-24-0x0000000004F40000-0x00000000050DB000-memory.dmp
memory/1796-25-0x0000000000B40000-0x0000000000B4C000-memory.dmp
memory/1796-26-0x0000000000B40000-0x0000000000B4C000-memory.dmp
memory/1796-28-0x0000000000B40000-0x0000000000B4C000-memory.dmp
memory/1796-29-0x0000000002EF0000-0x0000000002F19000-memory.dmp
memory/1796-30-0x0000000004E90000-0x00000000051B0000-memory.dmp
memory/1796-31-0x0000000002EF0000-0x0000000002F19000-memory.dmp
memory/1796-33-0x0000000004CA0000-0x0000000004D30000-memory.dmp
memory/3356-35-0x0000000004F40000-0x00000000050DB000-memory.dmp
memory/3356-37-0x0000000002940000-0x0000000002A02000-memory.dmp
memory/3356-39-0x0000000002940000-0x0000000002A02000-memory.dmp
memory/3356-42-0x0000000002940000-0x0000000002A02000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-04-01 19:04
Reported
2024-04-01 19:07
Platform
win10v2004-20240226-en
Max time kernel
149s
Max time network
148s
Command Line
Signatures
Xloader
Xloader payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 5068 set thread context of 2164 | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe |
| PID 2164 set thread context of 3508 | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | C:\Windows\Explorer.EXE |
| PID 3476 set thread context of 3508 | N/A | C:\Windows\SysWOW64\cmstp.exe | C:\Windows\Explorer.EXE |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmstp.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmstp.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\cmstp.exe | N/A |
Suspicious use of UnmapMainImage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Explorer.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe
"C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NovwaoBFfnCGA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCED9.tmp"
C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe
"C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe
"C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.117.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.28686ay.com | udp |
| US | 8.8.8.8:53 | www.imnntomen.xyz | udp |
| US | 8.8.8.8:53 | www.hallohesselmann.com | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.mgmdd.com | udp |
| US | 154.23.192.122:80 | www.mgmdd.com | tcp |
| US | 8.8.8.8:53 | 122.192.23.154.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.tinyspout.com | udp |
| US | 8.8.8.8:53 | www.2tina.com | udp |
| US | 8.8.8.8:53 | www.windowcompanynaperville.com | udp |
| US | 8.8.8.8:53 | www.qeeab.com | udp |
| US | 38.174.255.142:80 | www.qeeab.com | tcp |
| US | 8.8.8.8:53 | 142.255.174.38.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.holzmobil.eco | udp |
| DE | 89.31.143.90:80 | www.holzmobil.eco | tcp |
| US | 8.8.8.8:53 | 90.143.31.89.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.dalong56.com | udp |
| US | 102.134.41.247:80 | www.dalong56.com | tcp |
| US | 8.8.8.8:53 | 247.41.134.102.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.sonaliandshazad.com | udp |
| GB | 142.250.179.243:80 | www.sonaliandshazad.com | tcp |
| US | 8.8.8.8:53 | 243.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.fantacyfreshwaterfishing.com | udp |
| US | 3.33.130.190:80 | www.fantacyfreshwaterfishing.com | tcp |
| US | 8.8.8.8:53 | 190.130.33.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp |
Files
memory/5068-0-0x0000000000560000-0x000000000060E000-memory.dmp
memory/5068-1-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/5068-2-0x0000000005590000-0x0000000005B34000-memory.dmp
memory/5068-3-0x0000000005080000-0x0000000005112000-memory.dmp
memory/5068-4-0x0000000005050000-0x0000000005060000-memory.dmp
memory/5068-5-0x0000000005020000-0x000000000502A000-memory.dmp
memory/5068-6-0x0000000005560000-0x0000000005578000-memory.dmp
memory/5068-7-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/5068-8-0x0000000005050000-0x0000000005060000-memory.dmp
memory/5068-9-0x0000000006990000-0x0000000006A2C000-memory.dmp
memory/5068-10-0x0000000006AC0000-0x0000000006B26000-memory.dmp
memory/2164-16-0x0000000000400000-0x0000000000429000-memory.dmp
memory/5068-18-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/2164-19-0x0000000001990000-0x0000000001CDA000-memory.dmp
memory/2164-21-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2164-22-0x00000000018C0000-0x00000000018D1000-memory.dmp
memory/3508-23-0x0000000003040000-0x00000000030F7000-memory.dmp
memory/3476-24-0x0000000000410000-0x0000000000426000-memory.dmp
memory/3476-25-0x0000000000410000-0x0000000000426000-memory.dmp
memory/3476-26-0x0000000000B10000-0x0000000000B39000-memory.dmp
memory/3476-27-0x0000000002C70000-0x0000000002FBA000-memory.dmp
memory/3476-28-0x0000000000B10000-0x0000000000B39000-memory.dmp
memory/3476-29-0x0000000002AD0000-0x0000000002B60000-memory.dmp
memory/3508-33-0x0000000009110000-0x0000000009250000-memory.dmp
memory/3508-34-0x0000000009110000-0x0000000009250000-memory.dmp
memory/3508-37-0x0000000009110000-0x0000000009250000-memory.dmp
Analysis: behavioral4
Detonation Overview
Submitted
2024-04-01 19:04
Reported
2024-04-01 19:07
Platform
win11-20240221-en
Max time kernel
148s
Max time network
149s
Command Line
Signatures
Xloader
Xloader payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2168 set thread context of 2868 | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe |
| PID 2868 set thread context of 3372 | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | C:\Windows\Explorer.EXE |
| PID 2868 set thread context of 3372 | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | C:\Windows\Explorer.EXE |
| PID 2564 set thread context of 3372 | N/A | C:\Windows\SysWOW64\mstsc.exe | C:\Windows\Explorer.EXE |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\mstsc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\mstsc.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\mstsc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe
"C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NovwaoBFfnCGA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFFAD.tmp"
C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe
"C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dfw32m3.exe"
Network
| Country | Destination | Domain | Proto |
| US | 3.33.130.190:80 | www.fantacyfreshwaterfishing.com | tcp |
| US | 8.8.8.8:53 | www.28686ay.com | udp |
| US | 104.16.109.26:80 | www.monamodda.com | tcp |
| US | 173.254.28.240:80 | www.groundedexplorer.com | tcp |
| US | 108.186.41.69:80 | www.imnvr.com | tcp |
| US | 154.23.192.122:80 | www.mgmdd.com | tcp |
Files
memory/2168-0-0x0000000000320000-0x00000000003CE000-memory.dmp
memory/2168-1-0x0000000074F90000-0x0000000075741000-memory.dmp
memory/2168-2-0x00000000054B0000-0x0000000005A56000-memory.dmp
memory/2168-3-0x0000000004F00000-0x0000000004F92000-memory.dmp
memory/2168-4-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/2168-5-0x0000000004E70000-0x0000000004E7A000-memory.dmp
memory/2168-6-0x0000000006770000-0x0000000006788000-memory.dmp
memory/2168-7-0x0000000074F90000-0x0000000075741000-memory.dmp
memory/2168-8-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/2168-9-0x0000000006B40000-0x0000000006BDC000-memory.dmp
memory/2168-10-0x0000000006CD0000-0x0000000006D36000-memory.dmp
memory/2868-16-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2168-18-0x0000000074F90000-0x0000000075741000-memory.dmp
memory/2868-20-0x0000000001250000-0x00000000015A6000-memory.dmp
memory/3372-21-0x0000000003C50000-0x0000000003D9D000-memory.dmp
memory/2868-22-0x00000000011A0000-0x00000000011B1000-memory.dmp
memory/2868-23-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2868-25-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2868-26-0x0000000003150000-0x0000000003161000-memory.dmp
memory/3372-27-0x0000000006D50000-0x0000000006EF5000-memory.dmp
memory/2564-28-0x0000000000CD0000-0x0000000000E1E000-memory.dmp
memory/2564-30-0x0000000000CD0000-0x0000000000E1E000-memory.dmp
memory/2564-31-0x0000000000BC0000-0x0000000000BE9000-memory.dmp
memory/2564-32-0x0000000002FE0000-0x0000000003336000-memory.dmp
memory/2564-33-0x0000000000BC0000-0x0000000000BE9000-memory.dmp
memory/2564-35-0x0000000002DE0000-0x0000000002E70000-memory.dmp
memory/3372-36-0x0000000006D50000-0x0000000006EF5000-memory.dmp
memory/3372-38-0x0000000004640000-0x000000000471D000-memory.dmp
memory/3372-40-0x0000000004640000-0x000000000471D000-memory.dmp
memory/3372-43-0x0000000004640000-0x000000000471D000-memory.dmp