Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30-04-2024 01:13
Static task
static1
Behavioral task
behavioral1
Sample
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
General
-
Target
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe
-
Size
419KB
-
MD5
eddd297b2c76605d43ad789f9df03227
-
SHA1
e96b8968ba54658b1a87cf2dea36d6f08c59d68d
-
SHA256
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f
-
SHA512
b00b10feeb79be55e8759cce31224c58c48be00d8a7f0c4ac8a938fde6f44350da98672d46e1c17b25cdcbc3778bb55ae109abda3ed395aa9528b61b65619bf9
-
SSDEEP
6144:/9X0GEh9EyWfqG2ts8KYV/i43TsgyT4O/f/KNGCZErCYatEv3F5SzLg:J0VEsvPZG/XUGvCYaro
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
neontechvendors.com - Port:
587 - Username:
[email protected] - Password:
Mustfly@90 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs
Processes:
resource yara_rule behavioral1/memory/532-911-0x0000000000480000-0x00000000014E2000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/532-912-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
Processes:
resource yara_rule behavioral1/memory/532-911-0x0000000000480000-0x00000000014E2000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/532-912-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
Processes:
resource yara_rule behavioral1/memory/532-911-0x0000000000480000-0x00000000014E2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/532-912-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
Processes:
resource yara_rule behavioral1/memory/532-911-0x0000000000480000-0x00000000014E2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/532-912-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
Processes:
resource yara_rule behavioral1/memory/532-911-0x0000000000480000-0x00000000014E2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/532-912-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
Processes:
resource yara_rule behavioral1/memory/532-911-0x0000000000480000-0x00000000014E2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/532-912-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Loads dropped DLL 64 IoCs
Processes:
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exepid process 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 api.ipify.org 10 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exepid process 532 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exepid process 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 532 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exedescription pid process target process PID 1996 set thread context of 532 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe -
Drops file in Windows directory 1 IoCs
Processes:
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exedescription ioc process File opened for modification C:\Windows\Fonts\Prore64.cok 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exepid process 532 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe 532 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exepid process 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exedescription pid process Token: SeDebugPrivilege 532 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exedescription pid process target process PID 1996 wrote to memory of 1684 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1684 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1684 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1684 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2008 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2008 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2008 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2008 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2624 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2624 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2624 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2624 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2724 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2724 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2724 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2724 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2504 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2504 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2504 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2504 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2800 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2800 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2800 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2800 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2536 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2536 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2536 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2536 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2728 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2728 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2728 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2728 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1144 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1144 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1144 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1144 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2556 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2556 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2556 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2556 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2808 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2808 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2808 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2808 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2852 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2852 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2852 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2852 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1968 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1968 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1968 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1968 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1940 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1940 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1940 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1940 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1656 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1656 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1656 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 1656 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2232 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2232 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2232 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe PID 1996 wrote to memory of 2232 1996 33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe"C:\Users\Admin\AppData\Local\Temp\33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:1684
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2008
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2624
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2724
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2504
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2800
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2536
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2728
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"2⤵PID:1144
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"2⤵PID:2556
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2808
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:2852
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:1968
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1940
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:1656
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2232
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1668
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:2200
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1528
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1292
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1720
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:2372
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2004
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:828
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1508
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:836
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:1356
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2364
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1536
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:1380
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:2272
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:740
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2336
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:544
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2440
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:352
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2088
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1912
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2248
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:1852
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2644
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:2876
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2092
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:2532
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:2416
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2552
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2964
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2564
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2820
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2944
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1632
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1932
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1936
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2236
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1628
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:612
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:844
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2028
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2832
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2884
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2004
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:828
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1508
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:288
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1760
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:2320
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:1548
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1536
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1380
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1928
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1700
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2344
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2988
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2148
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:1500
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"2⤵PID:1696
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:1568
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"2⤵PID:2464
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"2⤵PID:1052
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2296
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"2⤵PID:1852
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2624
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2628
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2656
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2824
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"2⤵PID:2608
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2492
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1648
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2744
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:2680
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:2836
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2672
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:1968
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1940
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1952
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2472
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:2208
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:1512
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:1404
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:2032
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:304
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2832
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"2⤵PID:2372
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:484
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1492
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3060
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2456
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:444
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2424
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:996
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2128
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:896
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:344
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:840
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:2904
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:2252
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:3020
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2984
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:748
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2580
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1716
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2676
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2248
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2008
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2716
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:2872
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2868
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2524
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2544
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2780
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1436
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2740
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2840
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1964
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:2852
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:324
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1644
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:1544
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:1320
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1580
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2592
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:1276
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:1288
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1292
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:2448
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:1728
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:536
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:380
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1848
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2316
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:692
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1128
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2368
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:1552
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:1608
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"2⤵PID:1740
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:684
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:676
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3004
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1980
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2160
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:872
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:352
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2088
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2464
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:1052
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:2296
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:2760
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2624
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2600
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2776
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2824
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2608
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2420
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2584
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2564
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2808
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2668
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:280
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:1256
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2912
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:1952
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1576
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:1392
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:1512
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1376
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2032
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:304
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:1240
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2884
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:764
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1492
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1844
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:2456
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1356
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2424
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:1340
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2128
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:2300
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:344
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:888
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1344
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:772
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:544
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2440
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2932
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1704
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2192
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2588
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3024
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2696
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2700
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2876
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2444
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:2660
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:2416
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:2608
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:1144
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2748
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2684
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2736
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2216
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:468
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:2556
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1736
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2232
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2152
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2200
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:1748
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1528
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2028
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"2⤵PID:2900
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:1080
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:568
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2304
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:1640
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1844
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:2456
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:1356
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2424
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:1340
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"2⤵PID:2128
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2300
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:344
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:888
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:1344
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:772
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1504
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:804
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2932
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1704
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2192
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2588
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3024
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2696
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2624
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2788
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2444
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2660
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2416
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2608
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1144
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2748
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2820
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:744
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2216
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:468
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2556
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1736
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2232
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2152
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe"C:\Users\Admin\AppData\Local\Temp\33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsi1C67.tmp\System.dllFilesize
11KB
MD534442e1e0c2870341df55e1b7b3cccdc
SHA199b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA256269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
SHA5124a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
-
\Users\Admin\AppData\Local\Temp\nsi1C67.tmp\nsExec.dllFilesize
6KB
MD5ac0f93b2dec82e9579bff14c8572a6c8
SHA16460244317cbb77e342adb3561ec3acb496c84d5
SHA2563aa8e0abadefea2de58281198acfe48713a1d5b43aea5619f563cea098e9fd34
SHA5128055a6af150c45547927499f9cbf645d7f39c8e4f9caff4726fd711d2401abca01a79837095e5752b9f57b06446973ea6506796f2223bdb0179243d6e0575bd2
-
memory/532-910-0x0000000000480000-0x00000000014E2000-memory.dmpFilesize
16.4MB
-
memory/532-911-0x0000000000480000-0x00000000014E2000-memory.dmpFilesize
16.4MB
-
memory/532-912-0x0000000000480000-0x00000000004C0000-memory.dmpFilesize
256KB