Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:43
Static task
static1
Behavioral task
behavioral1
Sample
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240426-en
General
-
Target
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe
-
Size
430KB
-
MD5
d8b9553db2395d912f1e3976d8c6b73a
-
SHA1
f5cdbbd8c4691652469b7c64d212adef6d8e59f6
-
SHA256
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8
-
SHA512
4b0158ea63d69cb10034763d7d9745c309b8218d4ffb92d670423a6b04de1fbc360861ff02ca476edb0060183a43ef8a7bb8610b1bbe5dec11344412eb3d86de
-
SSDEEP
6144:/9X0GEh9EyWfqG2ts8KYV/i43TsgyT4O/f/KNr2WNhfihYiwBN3XMhwpqCHZQpI+:J0VEsvPZG/XUyeOwfchwB+pI+
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.escolaprofissionaltomar.com - Port:
587 - Username:
[email protected] - Password:
*Acnbc232430# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1496-628-0x0000000000480000-0x00000000016D4000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/1496-629-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1496-628-0x0000000000480000-0x00000000016D4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1496-629-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1496-628-0x0000000000480000-0x00000000016D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/1496-629-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1496-628-0x0000000000480000-0x00000000016D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1496-629-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1496-628-0x0000000000480000-0x00000000016D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/1496-629-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1496-628-0x0000000000480000-0x00000000016D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/1496-629-0x0000000000480000-0x00000000004C0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Loads dropped DLL 64 IoCs
Processes:
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exepid process 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 77 api.ipify.org 78 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exepid process 1496 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exepid process 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 1496 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exedescription pid process target process PID 2280 set thread context of 1496 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe -
Drops file in Windows directory 1 IoCs
Processes:
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exedescription ioc process File opened for modification C:\Windows\Fonts\Prore64.cok 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exepid process 1496 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe 1496 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exepid process 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exedescription pid process Token: SeDebugPrivilege 1496 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exedescription pid process target process PID 2280 wrote to memory of 4172 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4172 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4172 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1064 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1064 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1064 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3892 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3892 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3892 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3464 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3464 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3464 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4496 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4496 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4496 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3516 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3516 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3516 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 2380 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 2380 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 2380 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4408 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4408 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4408 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4516 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4516 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4516 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1868 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1868 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1868 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4144 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4144 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4144 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 2384 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 2384 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 2384 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 880 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 880 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 880 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4880 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4880 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4880 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3148 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3148 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 3148 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1448 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1448 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1448 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 5048 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 5048 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 5048 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 2472 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 2472 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 2472 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1984 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1984 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1984 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4356 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4356 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4356 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1820 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1820 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 1820 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe PID 2280 wrote to memory of 4136 2280 891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe"C:\Users\Admin\AppData\Local\Temp\891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:4172
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1064
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:3892
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3464
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:4496
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:3516
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2380
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4408
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"2⤵PID:4516
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"2⤵PID:1868
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:4144
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:2384
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:880
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4880
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:3148
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:1448
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:5048
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:2472
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1984
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4356
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1820
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:4136
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4692
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1944
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2836
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1608
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2840
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:3036
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:740
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:4492
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:880
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2536
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:4600
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:4932
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:4460
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1500
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:3836
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3896
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1196
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:4928
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2372
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:3920
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:1608
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:1596
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1180
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:4456
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4592
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3964
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:4328
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3572
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4036
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1996
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1480
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1908
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4792
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:1348
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:4440
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3516
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4412
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1736
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3648
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4716
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4732
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3824
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:3412
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:2944
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:628
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1096
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2924
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:4340
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4136
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2864
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1072
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:4792
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2108
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"2⤵PID:3324
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2252
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"2⤵PID:4240
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"2⤵PID:3404
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2476
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"2⤵PID:516
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:1044
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:5000
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4688
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4880
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"2⤵PID:3180
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3308
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2036
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:1872
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:564
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:2076
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1400
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:888
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1892
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:4496
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:3128
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:3280
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:3900
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:4412
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1736
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4960
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:812
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"2⤵PID:2608
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:4804
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3568
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4944
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1664
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:944
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1096
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4968
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2576
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4356
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:4808
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:636
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:5112
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:1916
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:848
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:3736
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2780
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:4456
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1300
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4760
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3444
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2012
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4344
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:3328
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:3572
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4544
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1480
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:696
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2864
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4904
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1072
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:5112
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:1916
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1676
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:3428
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:4960
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:3084
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3028
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:3668
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:3148
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2944
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2708
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:540
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:1448
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4340
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:4852
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3652
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4452
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:4136
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1908
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:3464
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2064
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:1656
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"2⤵PID:2484
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1288
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1304
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2476
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2116
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2608
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3564
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4912
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:5080
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1220
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:4460
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:540
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:3124
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4544
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1396
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:3128
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3308
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4356
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2824
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:564
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1808
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2252
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2484
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3736
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:1344
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:3752
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:3168
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:3028
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:3068
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:2904
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:544
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:4532
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:3888
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:5084
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:4504
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1996
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3920
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:740
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:216
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3440
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:4904
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:4692
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:4312
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:756
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4624
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1620
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4172
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2288
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4476
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3052
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1368
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4492
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2532
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2036
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4460
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:540
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2576
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1348
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1480
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:3780
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:4136
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:1944
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:5024
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:4792
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:3972
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:4884
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:4908
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:3828
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:4456
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:4508
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:628
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3028
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2436
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:4072
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:4588
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:5016
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"2⤵PID:1096
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:2716
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:3920
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:3756
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:2128
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1908
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:3656
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:3624
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:3324
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:852
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"2⤵PID:2256
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:3420
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1344
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:4456
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:4508
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:2396
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3224
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1420
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:4492
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2184
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4036
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1096
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:4040
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4564
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:740
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4496
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3672
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:5052
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:564
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:4412
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4316
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:664
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3828
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:4460
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2152
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1992
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3168
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:4476
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1640
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:4600
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe"C:\Users\Admin\AppData\Local\Temp\891408262a391aa3518471825e5bfe85b4fab8ec5385fc7082e5ad50ee67a8f8.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nss598B.tmp\System.dllFilesize
11KB
MD534442e1e0c2870341df55e1b7b3cccdc
SHA199b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA256269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
SHA5124a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
-
C:\Users\Admin\AppData\Local\Temp\nss598B.tmp\nsExec.dllFilesize
6KB
MD5ac0f93b2dec82e9579bff14c8572a6c8
SHA16460244317cbb77e342adb3561ec3acb496c84d5
SHA2563aa8e0abadefea2de58281198acfe48713a1d5b43aea5619f563cea098e9fd34
SHA5128055a6af150c45547927499f9cbf645d7f39c8e4f9caff4726fd711d2401abca01a79837095e5752b9f57b06446973ea6506796f2223bdb0179243d6e0575bd2
-
memory/1496-628-0x0000000000480000-0x00000000016D4000-memory.dmpFilesize
18.3MB
-
memory/1496-629-0x0000000000480000-0x00000000004C0000-memory.dmpFilesize
256KB
-
memory/1496-630-0x0000000037D10000-0x00000000382B4000-memory.dmpFilesize
5.6MB
-
memory/1496-631-0x0000000035580000-0x00000000355E6000-memory.dmpFilesize
408KB
-
memory/1496-633-0x0000000038740000-0x0000000038790000-memory.dmpFilesize
320KB
-
memory/1496-634-0x0000000038790000-0x0000000038822000-memory.dmpFilesize
584KB
-
memory/1496-635-0x0000000038860000-0x000000003886A000-memory.dmpFilesize
40KB