b25e337418210160d56418d18c32c2a44fc70254bc0b295b5c54f5dd5549c95d

General

Target

Transferencia.exe
Size

431KB
MD5

07cbab426f1bc77ca5d0f6a8fc1c9b4b
SHA1

70dc25df196c9bd87c2add428dc86b5f272eb15c
SHA256

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df
SHA512

a53c41aa20e76b7ee3baaa08aee3a4aa5361314a677ca753f68e1aca607fc8c8fdb3ab4f932991662976db2e1e30b5632bb7ebc5c12aa24dcb6703b5f311c9d7
SSDEEP

12288:Q0pZnHL9jAT8mU07ijSq/X7/8omMZ8LliOPZx:Q0pZnrhVG7imq/TdmMZ8Dx

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

Processes:

Transferencia.exe

pid	process
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe
3212	Transferencia.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

44 drive.google.com
45 drive.google.com
Drops file in System32 directory 1 IoCs

Processes:

Transferencia.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\undergrundslitteraturernes\warstlers.ini Transferencia.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Transferencia.exe

pid process

2672 Transferencia.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Transferencia.exeTransferencia.exe

pid process

3212 Transferencia.exe
2672 Transferencia.exe

flow	ioc
44	drive.google.com
45	drive.google.com

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\undergrundslitteraturernes\warstlers.ini	Transferencia.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Transferencia.exeTransferencia.exedvdplay.exe

description	pid	process	target process
PID 3212 set thread context of 2672	3212	Transferencia.exe	Transferencia.exe
PID 2672 set thread context of 3480	2672	Transferencia.exe	Explorer.EXE
PID 2672 set thread context of 1632	2672	Transferencia.exe	dvdplay.exe
PID 1632 set thread context of 3480	1632	dvdplay.exe	Explorer.EXE

Drops file in Windows directory 1 IoCs

Processes:

Transferencia.exe

description ioc process

File opened for modification C:\Windows\Fonts\starflower.thu Transferencia.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Fonts\starflower.thu	Transferencia.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

Transferencia.exedvdplay.exe

pid	process
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
2672	Transferencia.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe
1632	dvdplay.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Transferencia.exeTransferencia.exeExplorer.EXEdvdplay.exe

pid process

3212 Transferencia.exe
2672 Transferencia.exe
3480 Explorer.EXE
3480 Explorer.EXE
1632 dvdplay.exe
1632 dvdplay.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3480 Explorer.EXE

pid	process
3480	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Transferencia.exe

description	pid	process	target process
PID 3212 wrote to memory of 4932	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4932	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4932	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1064	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1064	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1064	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4656	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4656	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4656	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1380	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1380	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1380	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1884	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1884	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1884	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3132	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3132	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3132	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1520	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1520	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1520	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 2008	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 2008	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 2008	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4372	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4372	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4372	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1216	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1216	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1216	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1608	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1608	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1608	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3360	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3360	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3360	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3032	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3032	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3032	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 100	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 100	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 100	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4384	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4384	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4384	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1280	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1280	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1280	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4432	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4432	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 4432	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 2192	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 2192	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 2192	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3412	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3412	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 3412	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 2300	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 2300	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 2300	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1452	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1452	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 1452	3212	Transferencia.exe	cmd.exe
PID 3212 wrote to memory of 764	3212	Transferencia.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
PID:3480

C:\Users\Admin\AppData\Local\Temp\Transferencia.exe
"C:\Users\Admin\AppData\Local\Temp\Transferencia.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3212

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
3⤵
PID:4932

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:1064

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:4656

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1380

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:1884

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:3132

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x75^38"
3⤵
PID:4372

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4E^38"
3⤵
PID:1216

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
3⤵
PID:3360

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x71^38"
3⤵
PID:3032

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:100

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
3⤵
PID:4384

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:1280

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:4432

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
3⤵
PID:2192

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:3412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2300

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:764

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:3964

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:4320

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2620

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:2728

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:3100

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
3⤵
PID:2148

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:3268

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:4716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:4292

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:4668

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:2672

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:4336

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:5004

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:5100

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
3⤵
PID:916

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:5052

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x56^38"
3⤵
PID:5040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:1652

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
3⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:1620

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:3092

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3540

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:396

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:2104

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:4776

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:5036

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1292

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:4268

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3000

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1208

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:4772

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:704

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:4920

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:4628

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:4780

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:548

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3572

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:4648

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1204

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:4544

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
3⤵
PID:1012

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:3228

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:4012

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:2108

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2984

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:1868

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1676

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
3⤵
PID:864

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:4560

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x6D^38"
3⤵
PID:3320

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
3⤵
PID:3216

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x74^38"
3⤵
PID:5100

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x68^38"
3⤵
PID:4628

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
3⤵
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x6A^38"
3⤵
PID:4184

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:748

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:3592

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:4044

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x70^38"
3⤵
PID:2916

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:808

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:4120

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
3⤵
PID:2248

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
3⤵
PID:848

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1264

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x67^38"
3⤵
PID:4292

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1996

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:2672

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:3884

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:4960

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
3⤵
PID:624

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:3700

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:764

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:3132

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:4320

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0B^38"
3⤵
PID:3316

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
3⤵
PID:4940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2728

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3512

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2180

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:5036

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2328

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1880

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3416

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:4456

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:2016

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:704

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:4660

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:856

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
3⤵
PID:4564

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:3608

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:4068

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1204

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:4876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:3032

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:316

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:4252

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:3308

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:3076

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:4560

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1912

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:4500

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
3⤵
PID:2300

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:4800

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:3932

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x56^38"
3⤵
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:3152

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:3584

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:4080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:1704

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:4388

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:4540

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
3⤵
PID:884

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:3868

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:3268

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:4468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:3000

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2120

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
3⤵
PID:1996

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:4680

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:1668

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:208

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4D^38"
3⤵
PID:4864

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:3776

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:616

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:932

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
3⤵
PID:2316

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:4972

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1704

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:4388

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:4332

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:668

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
3⤵
PID:4108

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1F^38"
3⤵
PID:324

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:4260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:864

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3696

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2672

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:4500

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:3468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:4892

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:1504

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:548

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:3132

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:1824

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:4940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
3⤵
PID:3092

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:368

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:3512

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:3876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:4716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:1264

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:4252

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:4668

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2964

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:996

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
3⤵
PID:3320

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2624

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:208

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
3⤵
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:2936

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:4888

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:932

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:3332

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
3⤵
PID:2316

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1204

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:4460

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:4388

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:4776

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2984

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:848

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:4468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3000

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1208

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1996

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:4456

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:4524

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:3908

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:4424

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:4640

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:3712

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
3⤵
PID:2980

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:3264

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:1188

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:1072

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
3⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:1756

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:4708

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:3760

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:4788

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:5036

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:4288

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x65^38"
3⤵
PID:3416

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
3⤵
PID:1456

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:4880

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:3412

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x71^38"
3⤵
PID:3884

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:916

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
3⤵
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:2932

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:5052

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
3⤵
PID:548

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x76^38"
3⤵
PID:3132

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:3852

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:1824

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x67^38"
3⤵
PID:1704

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:4012

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:3800

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3868

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1292

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:1776

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:864

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:5004

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3496

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:4524

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:3908

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:880

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2932

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:5052

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2600

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1652

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2316

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:3080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:3624

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:3796

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:3304

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:1264

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:1632

C:\Users\Admin\AppData\Local\Temp\Transferencia.exe
"C:\Users\Admin\AppData\Local\Temp\Transferencia.exe"
3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2672

C:\Windows\SysWOW64\dvdplay.exe
"C:\Windows\SysWOW64\dvdplay.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi4EBD.tmp\System.dll

Filesize
12KB

MD5
12b140583e3273ee1f65016becea58c4

SHA1
92df24d11797fefd2e1f8d29be9dfd67c56c1ada

SHA256
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

SHA512
49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi4EBD.tmp\nsExec.dll

Filesize
6KB

MD5
4a2f4fe4a3ad1de56ee6bf7dd4923963

SHA1
7cc68b94448c964fd99904e5784b059aed4d5daa

SHA256
89b1e6509a1b45b32933e9d785a9c8c5b9ce7c616e1112dcf7fc3fa5ca27ebde

SHA512
4b6bbe75beafae9a29932ff5ddd3940aadfae62c157836e6cdab755955782dd5354d5eb389b4b8c16bf59f4ce7a099a0161d915c1cf2968f28e195dc8e3997ea

Download Submit
memory/1632-641-0x0000000001230000-0x000000000126F000-memory.dmp

Filesize
252KB

Download
memory/1632-643-0x0000000001230000-0x000000000126F000-memory.dmp

Filesize
252KB

Download
memory/2672-622-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2672-635-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2672-636-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2672-637-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2672-638-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2672-642-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3480-644-0x0000000009190000-0x0000000009296000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads