Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Centrotus.exe
windows7-x64
10Centrotus.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Flexibel/P...er.jad
windows7-x64
3Flexibel/P...er.jad
windows10-2004-x64
3Synfuel/Huspil81.asp
windows7-x64
3Synfuel/Huspil81.asp
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
Centrotus.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Centrotus.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Flexibel/Pygalgia/medlever.jad
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Flexibel/Pygalgia/medlever.jad
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Synfuel/Huspil81.asp
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Synfuel/Huspil81.asp
Resource
win10v2004-20240508-en
General
-
Target
Centrotus.exe
-
Size
759KB
-
MD5
ab19781723f4fc95135ea1c4fab2c5ac
-
SHA1
7667881fc0adcb94eaae71e680d6779581a8a869
-
SHA256
d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b
-
SHA512
55743e56af9948f2b657a7eb5a3a324d35fd55bf0537b9d7eec8931004813cef10b1e86d3960806da4e71146c12faa8d8a056154ca1563d2f2e576412842b502
-
SSDEEP
12288:KmNKDlHyYytPO2G6hqGGHfJWqbTGPObiUB:KmCHCpA6hqbWmV
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cash4cars.nz - Port:
587 - Username:
[email protected] - Password:
logs2024! - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL 64 IoCs
pid Process 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe 3000 Centrotus.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 drive.google.com 5 drive.google.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.ipify.org 11 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 572 Centrotus.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3000 Centrotus.exe 572 Centrotus.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3000 set thread context of 572 3000 Centrotus.exe 574 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\Fejlreaktions.tow Centrotus.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 572 Centrotus.exe 572 Centrotus.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3000 Centrotus.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 572 Centrotus.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2452 3000 Centrotus.exe 28 PID 3000 wrote to memory of 2452 3000 Centrotus.exe 28 PID 3000 wrote to memory of 2452 3000 Centrotus.exe 28 PID 3000 wrote to memory of 2452 3000 Centrotus.exe 28 PID 3000 wrote to memory of 2588 3000 Centrotus.exe 30 PID 3000 wrote to memory of 2588 3000 Centrotus.exe 30 PID 3000 wrote to memory of 2588 3000 Centrotus.exe 30 PID 3000 wrote to memory of 2588 3000 Centrotus.exe 30 PID 3000 wrote to memory of 2420 3000 Centrotus.exe 32 PID 3000 wrote to memory of 2420 3000 Centrotus.exe 32 PID 3000 wrote to memory of 2420 3000 Centrotus.exe 32 PID 3000 wrote to memory of 2420 3000 Centrotus.exe 32 PID 3000 wrote to memory of 2476 3000 Centrotus.exe 34 PID 3000 wrote to memory of 2476 3000 Centrotus.exe 34 PID 3000 wrote to memory of 2476 3000 Centrotus.exe 34 PID 3000 wrote to memory of 2476 3000 Centrotus.exe 34 PID 3000 wrote to memory of 2992 3000 Centrotus.exe 36 PID 3000 wrote to memory of 2992 3000 Centrotus.exe 36 PID 3000 wrote to memory of 2992 3000 Centrotus.exe 36 PID 3000 wrote to memory of 2992 3000 Centrotus.exe 36 PID 3000 wrote to memory of 2716 3000 Centrotus.exe 38 PID 3000 wrote to memory of 2716 3000 Centrotus.exe 38 PID 3000 wrote to memory of 2716 3000 Centrotus.exe 38 PID 3000 wrote to memory of 2716 3000 Centrotus.exe 38 PID 3000 wrote to memory of 2788 3000 Centrotus.exe 40 PID 3000 wrote to memory of 2788 3000 Centrotus.exe 40 PID 3000 wrote to memory of 2788 3000 Centrotus.exe 40 PID 3000 wrote to memory of 2788 3000 Centrotus.exe 40 PID 3000 wrote to memory of 2980 3000 Centrotus.exe 42 PID 3000 wrote to memory of 2980 3000 Centrotus.exe 42 PID 3000 wrote to memory of 2980 3000 Centrotus.exe 42 PID 3000 wrote to memory of 2980 3000 Centrotus.exe 42 PID 3000 wrote to memory of 800 3000 Centrotus.exe 44 PID 3000 wrote to memory of 800 3000 Centrotus.exe 44 PID 3000 wrote to memory of 800 3000 Centrotus.exe 44 PID 3000 wrote to memory of 800 3000 Centrotus.exe 44 PID 3000 wrote to memory of 1272 3000 Centrotus.exe 46 PID 3000 wrote to memory of 1272 3000 Centrotus.exe 46 PID 3000 wrote to memory of 1272 3000 Centrotus.exe 46 PID 3000 wrote to memory of 1272 3000 Centrotus.exe 46 PID 3000 wrote to memory of 1568 3000 Centrotus.exe 48 PID 3000 wrote to memory of 1568 3000 Centrotus.exe 48 PID 3000 wrote to memory of 1568 3000 Centrotus.exe 48 PID 3000 wrote to memory of 1568 3000 Centrotus.exe 48 PID 3000 wrote to memory of 1324 3000 Centrotus.exe 50 PID 3000 wrote to memory of 1324 3000 Centrotus.exe 50 PID 3000 wrote to memory of 1324 3000 Centrotus.exe 50 PID 3000 wrote to memory of 1324 3000 Centrotus.exe 50 PID 3000 wrote to memory of 2524 3000 Centrotus.exe 52 PID 3000 wrote to memory of 2524 3000 Centrotus.exe 52 PID 3000 wrote to memory of 2524 3000 Centrotus.exe 52 PID 3000 wrote to memory of 2524 3000 Centrotus.exe 52 PID 3000 wrote to memory of 2464 3000 Centrotus.exe 54 PID 3000 wrote to memory of 2464 3000 Centrotus.exe 54 PID 3000 wrote to memory of 2464 3000 Centrotus.exe 54 PID 3000 wrote to memory of 2464 3000 Centrotus.exe 54 PID 3000 wrote to memory of 1232 3000 Centrotus.exe 56 PID 3000 wrote to memory of 1232 3000 Centrotus.exe 56 PID 3000 wrote to memory of 1232 3000 Centrotus.exe 56 PID 3000 wrote to memory of 1232 3000 Centrotus.exe 56 PID 3000 wrote to memory of 2292 3000 Centrotus.exe 58 PID 3000 wrote to memory of 2292 3000 Centrotus.exe 58 PID 3000 wrote to memory of 2292 3000 Centrotus.exe 58 PID 3000 wrote to memory of 2292 3000 Centrotus.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\Centrotus.exe"C:\Users\Admin\AppData\Local\Temp\Centrotus.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:2452
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2588
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2420
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2476
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2992
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2716
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2788
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2980
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"2⤵PID:800
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"2⤵PID:1272
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1568
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:1324
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:2524
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2464
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:1232
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2292
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2248
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:1952
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:2864
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:396
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:632
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2908
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1956
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1768
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:1656
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1688
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:2132
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:2328
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2188
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2164
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2200
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2988
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2528
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2720
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2556
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2732
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:2312
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2480
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:2496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2936
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:1708
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:2780
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2956
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2484
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1044
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2236
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1472
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2976
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2888
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1252
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1260
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:268
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:2072
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:1712
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1960
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1632
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:580
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:944
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1744
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1772
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:956
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:1940
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:1656
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1536
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1716
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1972
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1804
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2328
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1988
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1676
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:3012
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"2⤵PID:2516
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2628
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"2⤵PID:2576
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"2⤵PID:2748
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"2⤵PID:2452
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2560
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2480
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2500
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2592
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"2⤵PID:2700
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2916
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2788
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:1812
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:1700
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:1620
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:1984
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2976
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1640
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:560
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:1760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:484
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1944
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2868
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2096
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"2⤵PID:396
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:580
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2380
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:448
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1348
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1248
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:756
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:1684
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:988
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1748
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:1992
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1584
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2828
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:2760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2988
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2280
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2852
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2548
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2584
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:2620
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2436
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1624
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2792
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2924
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2804
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2912
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2944
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:1776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1696
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1472
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:2660
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:1356
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1284
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2060
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2120
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2248
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:1712
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:1960
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1264
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:1476
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1856
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1084
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:832
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:376
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:764
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:600
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"2⤵PID:1916
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1780
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1784
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2224
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1924
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1580
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2212
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2176
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1980
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3068
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:2572
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:2632
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:2748
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2452
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2428
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2544
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1912
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2696
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2512
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2916
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2788
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2980
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2664
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:1620
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:1704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2708
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:2800
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:684
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:560
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2100
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2248
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1712
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1960
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1264
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1476
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:944
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:448
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2104
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:1364
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:1248
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:304
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:600
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1916
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1780
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1784
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2224
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2892
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2324
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2208
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2880
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2532
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2720
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2556
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2548
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3020
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2560
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2624
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2264
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2716
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:1376
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:1800
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:800
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2944
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:1776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1696
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:1984
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2976
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:1300
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:1556
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2364
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:572
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"2⤵PID:2112
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:2848
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2304
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2864
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:1632
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2960
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:1856
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2068
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1540
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"2⤵PID:1940
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:620
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:756
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:2336
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1188
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:872
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1924
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1580
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2828
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2988
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2636
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2640
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2840
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2744
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2452
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2560
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1624
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1708
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2772
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1600
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2412
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2980
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2664
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1696
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1984
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\Centrotus.exe"C:\Users\Admin\AppData\Local\Temp\Centrotus.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5e23600029d1b09bdb1d422fb4e46f5a6
SHA15d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA2567342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
SHA512c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac
-
Filesize
6KB
MD53d2adaa3d221fda021e6c08d987bdaad
SHA12e4739d2d1bff8e4c093b913f3f4523ffc977cfa
SHA25628ad93c4a8d4357a13c17c615f21a2166984e2a438c1a1c1dd2e1c99d3640b16
SHA512294e84892356e2abfbb14f00ad4fd5457dd63a6740bfd0de3457f321eae7807d4b06d2fda81aad1bbf0af4d9188c332c0578f224550d82745bdff03dd370d0f4