b25e337418210160d56418d18c32c2a44fc70254bc0b295b5c54f5dd5549c95d

General

Target

Transferencia.exe
Size

431KB
MD5

07cbab426f1bc77ca5d0f6a8fc1c9b4b
SHA1

70dc25df196c9bd87c2add428dc86b5f272eb15c
SHA256

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df
SHA512

a53c41aa20e76b7ee3baaa08aee3a4aa5361314a677ca753f68e1aca607fc8c8fdb3ab4f932991662976db2e1e30b5632bb7ebc5c12aa24dcb6703b5f311c9d7
SSDEEP

12288:Q0pZnHL9jAT8mU07ijSq/X7/8omMZ8LliOPZx:Q0pZnrhVG7imq/TdmMZ8Dx

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

Processes:

Transferencia.exe

pid	process
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe
2076	Transferencia.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 drive.google.com
5 drive.google.com
Drops file in System32 directory 1 IoCs

Processes:

Transferencia.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\undergrundslitteraturernes\warstlers.ini Transferencia.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Transferencia.exe

pid process

904 Transferencia.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Transferencia.exeTransferencia.exe

pid process

2076 Transferencia.exe
904 Transferencia.exe

flow	ioc
3	drive.google.com
5	drive.google.com

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\undergrundslitteraturernes\warstlers.ini	Transferencia.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Transferencia.exeTransferencia.exedvdplay.exe

description	pid	process	target process
PID 2076 set thread context of 904	2076	Transferencia.exe	Transferencia.exe
PID 904 set thread context of 1228	904	Transferencia.exe	Explorer.EXE
PID 904 set thread context of 2832	904	Transferencia.exe	dvdplay.exe
PID 2832 set thread context of 1228	2832	dvdplay.exe	Explorer.EXE

Drops file in Windows directory 1 IoCs

Processes:

Transferencia.exe

description ioc process

File opened for modification C:\Windows\Fonts\starflower.thu Transferencia.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Fonts\starflower.thu	Transferencia.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

Transferencia.exedvdplay.exe

pid	process
904	Transferencia.exe
904	Transferencia.exe
904	Transferencia.exe
904	Transferencia.exe
904	Transferencia.exe
904	Transferencia.exe
904	Transferencia.exe
904	Transferencia.exe
2832	dvdplay.exe
2832	dvdplay.exe
2832	dvdplay.exe
2832	dvdplay.exe
2832	dvdplay.exe
2832	dvdplay.exe
2832	dvdplay.exe
2832	dvdplay.exe
2832	dvdplay.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Transferencia.exeTransferencia.exeExplorer.EXEdvdplay.exe

pid process

2076 Transferencia.exe
904 Transferencia.exe
1228 Explorer.EXE
1228 Explorer.EXE
2832 dvdplay.exe
2832 dvdplay.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Transferencia.exe

description	pid	process	target process
PID 2076 wrote to memory of 2792	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2792	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2792	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2792	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2956	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2956	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2956	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2956	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2668	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2668	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2668	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2668	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2584	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2584	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2584	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2584	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2436	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2436	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2436	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2436	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2652	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2652	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2652	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2652	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2596	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2596	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2596	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2596	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2444	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2444	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2444	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2444	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2208	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2208	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2208	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2208	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2888	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2888	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2888	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2888	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2416	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2416	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2416	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2416	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2764	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2764	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2764	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2764	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2260	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2260	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2260	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 2260	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 784	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 784	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 784	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 784	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 1632	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 1632	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 1632	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 1632	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 548	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 548	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 548	2076	Transferencia.exe	cmd.exe
PID 2076 wrote to memory of 548	2076	Transferencia.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
PID:1228

C:\Users\Admin\AppData\Local\Temp\Transferencia.exe
"C:\Users\Admin\AppData\Local\Temp\Transferencia.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
3⤵
PID:2792

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:2956

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:2668

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2584

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:2436

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:2652

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2596

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2444

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x75^38"
3⤵
PID:2208

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4E^38"
3⤵
PID:2888

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:2416

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
3⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x71^38"
3⤵
PID:2260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:784

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
3⤵
PID:1632

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:548

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:2176

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
3⤵
PID:596

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:1068

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2788

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:2908

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:2832

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:1356

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:2328

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:2092

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
3⤵
PID:1672

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:1256

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1048

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:1876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:2808

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:2056

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:1460

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
3⤵
PID:2720

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:2240

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x56^38"
3⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:2656

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
3⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:2204

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2480

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:3044

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:1648

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2396

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:636

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:1260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:1696

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:696

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:380

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3064

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:588

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1780

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1492

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:2748

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
3⤵
PID:2152

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1012

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2996

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:1364

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1636

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:1052

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1044

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
3⤵
PID:936

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:1320

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x6D^38"
3⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
3⤵
PID:2348

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x74^38"
3⤵
PID:2228

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x68^38"
3⤵
PID:2352

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
3⤵
PID:2916

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x6A^38"
3⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:2792

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:2976

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2680

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x70^38"
3⤵
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2776

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:2544

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
3⤵
PID:2424

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
3⤵
PID:2208

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:2888

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x67^38"
3⤵
PID:2728

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:2772

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1828

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:2168

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:2344

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
3⤵
PID:2404

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:1664

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:2256

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:324

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:892

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0B^38"
3⤵
PID:2872

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
3⤵
PID:864

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2144

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:748

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2136

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:588

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1780

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2276

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2516

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:576

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:1148

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:2952

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:1364

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:1636

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:1052

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:1044

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
3⤵
PID:936

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:1320

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2808

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2796

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1592

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1460

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:1748

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:2876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:3024

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1532

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2592

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2440

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
3⤵
PID:2500

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:3044

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:1648

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x56^38"
3⤵
PID:1972

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1332

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:320

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:1640

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:1816

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:636

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
3⤵
PID:1984

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:1696

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:604

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:3000

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
3⤵
PID:1508

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:2412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:2084

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:1376

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4D^38"
3⤵
PID:1808

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:712

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2968

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1712

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
3⤵
PID:2984

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1164

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1048

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:708

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3032

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:1220

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
3⤵
PID:1776

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1F^38"
3⤵
PID:2072

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1756

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2612

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2792

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2976

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2680

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2700

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:2552

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:820

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:1688

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:2724

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
3⤵
PID:2772

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:1828

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2168

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:2344

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:2780

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1804

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:480

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2216

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:648

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
3⤵
PID:2524

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:2284

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
3⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:1412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2832

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1300

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2980

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
3⤵
PID:3036

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2828

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:972

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:280

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:868

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1168

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1208

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:1736

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:2360

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:2976

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:2680

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
3⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
3⤵
PID:2700

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:2472

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:2892

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:2728

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:2772

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:1828

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2168

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x65^38"
3⤵
PID:2344

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
3⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:2780

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1804

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x71^38"
3⤵
PID:560

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1668

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
3⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:2088

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:2020

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
3⤵
PID:2284

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x76^38"
3⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:2832

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x67^38"
3⤵
PID:1300

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:2980

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1692

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1672

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:1636

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:868

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1168

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1360

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1120

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2520

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2240

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2664

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2620

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1592

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2424

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2312

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:2732

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:2740

C:\Users\Admin\AppData\Local\Temp\Transferencia.exe
"C:\Users\Admin\AppData\Local\Temp\Transferencia.exe"
3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:904

C:\Windows\SysWOW64\dvdplay.exe
"C:\Windows\SysWOW64\dvdplay.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2832

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst3026.tmp\System.dll
Filesize
12KB

MD5
12b140583e3273ee1f65016becea58c4

SHA1
92df24d11797fefd2e1f8d29be9dfd67c56c1ada

SHA256
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

SHA512
49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

Download Submit
\Users\Admin\AppData\Local\Temp\nst3026.tmp\nsExec.dll
Filesize
6KB

MD5
4a2f4fe4a3ad1de56ee6bf7dd4923963

SHA1
7cc68b94448c964fd99904e5784b059aed4d5daa

SHA256
89b1e6509a1b45b32933e9d785a9c8c5b9ce7c616e1112dcf7fc3fa5ca27ebde

SHA512
4b6bbe75beafae9a29932ff5ddd3940aadfae62c157836e6cdab755955782dd5354d5eb389b4b8c16bf59f4ce7a099a0161d915c1cf2968f28e195dc8e3997ea

Download Submit
memory/904-897-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/904-919-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/904-921-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/904-923-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/904-922-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/904-924-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/904-931-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2832-930-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/2832-933-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads