Overview
overview
10Static
static
3Centrotus.exe
windows7-x64
10Centrotus.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Flexibel/P...er.jad
windows7-x64
3Flexibel/P...er.jad
windows10-2004-x64
3Synfuel/Huspil81.asp
windows7-x64
3Synfuel/Huspil81.asp
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
Centrotus.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Centrotus.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Flexibel/Pygalgia/medlever.jad
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Flexibel/Pygalgia/medlever.jad
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Synfuel/Huspil81.asp
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Synfuel/Huspil81.asp
Resource
win10v2004-20240508-en
General
-
Target
Centrotus.exe
-
Size
759KB
-
MD5
ab19781723f4fc95135ea1c4fab2c5ac
-
SHA1
7667881fc0adcb94eaae71e680d6779581a8a869
-
SHA256
d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b
-
SHA512
55743e56af9948f2b657a7eb5a3a324d35fd55bf0537b9d7eec8931004813cef10b1e86d3960806da4e71146c12faa8d8a056154ca1563d2f2e576412842b502
-
SSDEEP
12288:KmNKDlHyYytPO2G6hqGGHfJWqbTGPObiUB:KmCHCpA6hqbWmV
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cash4cars.nz - Port:
587 - Username:
[email protected] - Password:
logs2024! - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL 64 IoCs
pid Process 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe 2356 Centrotus.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 45 drive.google.com 46 drive.google.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 53 api.ipify.org 54 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1572 Centrotus.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2356 Centrotus.exe 1572 Centrotus.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2356 set thread context of 1572 2356 Centrotus.exe 642 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\Fejlreaktions.tow Centrotus.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1572 Centrotus.exe 1572 Centrotus.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2356 Centrotus.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1572 Centrotus.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 232 2356 Centrotus.exe 88 PID 2356 wrote to memory of 232 2356 Centrotus.exe 88 PID 2356 wrote to memory of 232 2356 Centrotus.exe 88 PID 2356 wrote to memory of 3900 2356 Centrotus.exe 90 PID 2356 wrote to memory of 3900 2356 Centrotus.exe 90 PID 2356 wrote to memory of 3900 2356 Centrotus.exe 90 PID 2356 wrote to memory of 3412 2356 Centrotus.exe 94 PID 2356 wrote to memory of 3412 2356 Centrotus.exe 94 PID 2356 wrote to memory of 3412 2356 Centrotus.exe 94 PID 2356 wrote to memory of 4664 2356 Centrotus.exe 96 PID 2356 wrote to memory of 4664 2356 Centrotus.exe 96 PID 2356 wrote to memory of 4664 2356 Centrotus.exe 96 PID 2356 wrote to memory of 1548 2356 Centrotus.exe 98 PID 2356 wrote to memory of 1548 2356 Centrotus.exe 98 PID 2356 wrote to memory of 1548 2356 Centrotus.exe 98 PID 2356 wrote to memory of 3544 2356 Centrotus.exe 101 PID 2356 wrote to memory of 3544 2356 Centrotus.exe 101 PID 2356 wrote to memory of 3544 2356 Centrotus.exe 101 PID 2356 wrote to memory of 1184 2356 Centrotus.exe 103 PID 2356 wrote to memory of 1184 2356 Centrotus.exe 103 PID 2356 wrote to memory of 1184 2356 Centrotus.exe 103 PID 2356 wrote to memory of 1480 2356 Centrotus.exe 105 PID 2356 wrote to memory of 1480 2356 Centrotus.exe 105 PID 2356 wrote to memory of 1480 2356 Centrotus.exe 105 PID 2356 wrote to memory of 3308 2356 Centrotus.exe 107 PID 2356 wrote to memory of 3308 2356 Centrotus.exe 107 PID 2356 wrote to memory of 3308 2356 Centrotus.exe 107 PID 2356 wrote to memory of 2312 2356 Centrotus.exe 109 PID 2356 wrote to memory of 2312 2356 Centrotus.exe 109 PID 2356 wrote to memory of 2312 2356 Centrotus.exe 109 PID 2356 wrote to memory of 4568 2356 Centrotus.exe 111 PID 2356 wrote to memory of 4568 2356 Centrotus.exe 111 PID 2356 wrote to memory of 4568 2356 Centrotus.exe 111 PID 2356 wrote to memory of 2456 2356 Centrotus.exe 113 PID 2356 wrote to memory of 2456 2356 Centrotus.exe 113 PID 2356 wrote to memory of 2456 2356 Centrotus.exe 113 PID 2356 wrote to memory of 4540 2356 Centrotus.exe 116 PID 2356 wrote to memory of 4540 2356 Centrotus.exe 116 PID 2356 wrote to memory of 4540 2356 Centrotus.exe 116 PID 2356 wrote to memory of 4416 2356 Centrotus.exe 119 PID 2356 wrote to memory of 4416 2356 Centrotus.exe 119 PID 2356 wrote to memory of 4416 2356 Centrotus.exe 119 PID 2356 wrote to memory of 2140 2356 Centrotus.exe 121 PID 2356 wrote to memory of 2140 2356 Centrotus.exe 121 PID 2356 wrote to memory of 2140 2356 Centrotus.exe 121 PID 2356 wrote to memory of 2352 2356 Centrotus.exe 123 PID 2356 wrote to memory of 2352 2356 Centrotus.exe 123 PID 2356 wrote to memory of 2352 2356 Centrotus.exe 123 PID 2356 wrote to memory of 4132 2356 Centrotus.exe 125 PID 2356 wrote to memory of 4132 2356 Centrotus.exe 125 PID 2356 wrote to memory of 4132 2356 Centrotus.exe 125 PID 2356 wrote to memory of 2932 2356 Centrotus.exe 127 PID 2356 wrote to memory of 2932 2356 Centrotus.exe 127 PID 2356 wrote to memory of 2932 2356 Centrotus.exe 127 PID 2356 wrote to memory of 3304 2356 Centrotus.exe 129 PID 2356 wrote to memory of 3304 2356 Centrotus.exe 129 PID 2356 wrote to memory of 3304 2356 Centrotus.exe 129 PID 2356 wrote to memory of 4584 2356 Centrotus.exe 131 PID 2356 wrote to memory of 4584 2356 Centrotus.exe 131 PID 2356 wrote to memory of 4584 2356 Centrotus.exe 131 PID 2356 wrote to memory of 3628 2356 Centrotus.exe 133 PID 2356 wrote to memory of 3628 2356 Centrotus.exe 133 PID 2356 wrote to memory of 3628 2356 Centrotus.exe 133 PID 2356 wrote to memory of 868 2356 Centrotus.exe 135
Processes
-
C:\Users\Admin\AppData\Local\Temp\Centrotus.exe"C:\Users\Admin\AppData\Local\Temp\Centrotus.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:232
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:3900
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:3412
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4664
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:1548
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:3544
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1184
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1480
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"2⤵PID:3308
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"2⤵PID:2312
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:4568
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:2456
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:4540
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4416
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:2140
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2352
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:4132
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:3304
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4584
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3628
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:868
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3408
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4164
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4960
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2956
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:3200
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:3744
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1044
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:4596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3580
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:3860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:1776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:4176
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1232
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:228
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4068
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:4808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:3196
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:5020
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:3596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:3544
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:4372
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:3916
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:388
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1444
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:532
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4856
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4308
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2436
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3248
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4680
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:1464
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:4668
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3376
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1512
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3352
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3196
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:5020
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3696
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:4968
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:2928
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2312
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4656
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1500
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4200
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:3860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2140
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:3568
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:3836
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"2⤵PID:4444
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:228
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"2⤵PID:3376
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"2⤵PID:1512
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:4760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"2⤵PID:780
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:4888
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:4960
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4612
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"2⤵PID:1004
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:4524
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:1676
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:4468
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1568
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:732
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1328
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2156
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:4740
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2168
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:1036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:3196
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4888
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4844
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"2⤵PID:1496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:1128
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1004
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4864
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4904
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1688
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4308
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4576
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1200
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:4328
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:5076
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:4808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3964
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:4528
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:1036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:1056
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:5080
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3516
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2284
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1128
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:4492
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:5028
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4640
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2292
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:452
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4268
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1840
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2384
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:2372
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1412
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:4212
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:2636
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2088
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4876
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:3496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:3156
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:1496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:3628
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:3056
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:3588
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:5028
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:3608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2140
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:1464
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1328
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2752
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:4756
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:3052
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"2⤵PID:1560
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:4920
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2516
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3284
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:884
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:3496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3156
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4968
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2632
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4904
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:4804
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:4308
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:4576
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1732
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1352
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4452
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4144
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2172
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3476
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:4748
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:4388
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4888
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:2912
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:3516
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:3156
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:4968
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:2632
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:4904
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:528
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:3520
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2564
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:4176
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:4900
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2428
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3488
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:5108
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2840
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:4852
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:1056
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:4884
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:3972
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1484
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2656
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:532
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2284
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:5048
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3252
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3480
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:792
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2564
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4176
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4900
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2428
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3488
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:4808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:4532
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1560
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:4920
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2088
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2996
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:4612
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:3696
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1264
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:3628
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:220
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3252
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:3480
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:792
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2564
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4176
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"2⤵PID:1996
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:2428
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:3488
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:4808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:4532
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2232
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:2208
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:4208
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:4888
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:1508
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"2⤵PID:3964
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:532
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:5004
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:3760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:3568
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1524
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4104
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3356
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1512
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1548
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4528
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4908
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3192
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:388
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2928
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2656
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4732
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:212
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4812
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:528
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:732
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2220
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3848
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3836
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4900
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1360
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\Centrotus.exe"C:\Users\Admin\AppData\Local\Temp\Centrotus.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5e23600029d1b09bdb1d422fb4e46f5a6
SHA15d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA2567342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
SHA512c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac
-
Filesize
6KB
MD53d2adaa3d221fda021e6c08d987bdaad
SHA12e4739d2d1bff8e4c093b913f3f4523ffc977cfa
SHA25628ad93c4a8d4357a13c17c615f21a2166984e2a438c1a1c1dd2e1c99d3640b16
SHA512294e84892356e2abfbb14f00ad4fd5457dd63a6740bfd0de3457f321eae7807d4b06d2fda81aad1bbf0af4d9188c332c0578f224550d82745bdff03dd370d0f4