b25e337418210160d56418d18c32c2a44fc70254bc0b295b5c54f5dd5549c95d

General

Target

Transferencia.exe
Size

431KB
MD5

07cbab426f1bc77ca5d0f6a8fc1c9b4b
SHA1

70dc25df196c9bd87c2add428dc86b5f272eb15c
SHA256

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df
SHA512

a53c41aa20e76b7ee3baaa08aee3a4aa5361314a677ca753f68e1aca607fc8c8fdb3ab4f932991662976db2e1e30b5632bb7ebc5c12aa24dcb6703b5f311c9d7
SSDEEP

12288:Q0pZnHL9jAT8mU07ijSq/X7/8omMZ8LliOPZx:Q0pZnrhVG7imq/TdmMZ8Dx

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

Processes:

Transferencia.exe

pid	process
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe
1932	Transferencia.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 drive.google.com
5 drive.google.com
Drops file in System32 directory 1 IoCs

Processes:

Transferencia.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\undergrundslitteraturernes\warstlers.ini Transferencia.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Transferencia.exe

pid process

1512 Transferencia.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Transferencia.exeTransferencia.exe

pid process

1932 Transferencia.exe
1512 Transferencia.exe

flow	ioc
3	drive.google.com
5	drive.google.com

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\undergrundslitteraturernes\warstlers.ini	Transferencia.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Transferencia.exeTransferencia.exedvdplay.exe

description	pid	process	target process
PID 1932 set thread context of 1512	1932	Transferencia.exe	Transferencia.exe
PID 1512 set thread context of 1196	1512	Transferencia.exe	Explorer.EXE
PID 1512 set thread context of 1356	1512	Transferencia.exe	dvdplay.exe
PID 1356 set thread context of 1196	1356	dvdplay.exe	Explorer.EXE

Drops file in Windows directory 1 IoCs

Processes:

Transferencia.exe

description ioc process

File opened for modification C:\Windows\Fonts\starflower.thu Transferencia.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Fonts\starflower.thu	Transferencia.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

Transferencia.exedvdplay.exe

pid	process
1512	Transferencia.exe
1512	Transferencia.exe
1512	Transferencia.exe
1512	Transferencia.exe
1512	Transferencia.exe
1512	Transferencia.exe
1512	Transferencia.exe
1512	Transferencia.exe
1356	dvdplay.exe
1356	dvdplay.exe
1356	dvdplay.exe
1356	dvdplay.exe
1356	dvdplay.exe
1356	dvdplay.exe
1356	dvdplay.exe
1356	dvdplay.exe
1356	dvdplay.exe
1356	dvdplay.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Transferencia.exeTransferencia.exeExplorer.EXEdvdplay.exe

pid process

1932 Transferencia.exe
1512 Transferencia.exe
1196 Explorer.EXE
1196 Explorer.EXE
1356 dvdplay.exe
1356 dvdplay.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Transferencia.exe

description	pid	process	target process
PID 1932 wrote to memory of 1040	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1040	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1040	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1040	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2660	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2660	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2660	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2660	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2664	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2664	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2664	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2664	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2292	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2292	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2292	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2292	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2508	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2508	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2508	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2508	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2640	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2640	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2640	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2640	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2468	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2468	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2468	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2468	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 796	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 796	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 796	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 796	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1936	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1936	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1936	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1936	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1688	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1688	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1688	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1688	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2460	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2460	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2460	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2460	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2784	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2784	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2784	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2784	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1912	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1912	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1912	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1912	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2000	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2000	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2000	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2000	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1324	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1324	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1324	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 1324	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2380	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2380	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2380	1932	Transferencia.exe	cmd.exe
PID 1932 wrote to memory of 2380	1932	Transferencia.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
PID:1196

C:\Users\Admin\AppData\Local\Temp\Transferencia.exe
"C:\Users\Admin\AppData\Local\Temp\Transferencia.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
3⤵
PID:1040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:2664

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:2640

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:796

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x75^38"
3⤵
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4E^38"
3⤵
PID:1688

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:2460

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
3⤵
PID:2784

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x71^38"
3⤵
PID:1912

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2000

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
3⤵
PID:1324

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:568

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
3⤵
PID:1528

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2272

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:2832

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1772

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:988

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:1220

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:1672

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
3⤵
PID:1080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:1636

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:900

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:2220

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:2864

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:2852

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1576

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2556

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2116

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
3⤵
PID:1040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x56^38"
3⤵
PID:2664

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
3⤵
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:2640

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:2536

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2736

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:552

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2776

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2108

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2944

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1980

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:304

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:2340

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:2420

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2228

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:912

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2848

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2260

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1148

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1628

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2872

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:1220

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
3⤵
PID:444

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1652

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:1352

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:3064

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:840

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
3⤵
PID:2808

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:1368

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x6D^38"
3⤵
PID:1156

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
3⤵
PID:2080

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x74^38"
3⤵
PID:2940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x68^38"
3⤵
PID:2120

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
3⤵
PID:2960

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x6A^38"
3⤵
PID:2980

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:2668

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2664

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2588

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x70^38"
3⤵
PID:2920

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2472

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2924

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
3⤵
PID:2908

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
3⤵
PID:1664

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:2460

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x67^38"
3⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:2516

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:2376

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x63^38"
3⤵
PID:2132

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:296

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:2188

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0B^38"
3⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
3⤵
PID:2244

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2848

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1264

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:572

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:584

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1800

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:984

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2332

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:1840

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:1600

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:2860

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:1636

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:880

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
3⤵
PID:340

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:1336

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1724

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1584

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1320

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2656

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5E^38"
3⤵
PID:2828

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:2728

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2720

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2640

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2548

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:796

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
3⤵
PID:892

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x56^38"
3⤵
PID:2108

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:316

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1252

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:2172

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:2396

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:1736

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
3⤵
PID:2176

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2228

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:2276

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:680

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
3⤵
PID:324

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:528

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:2512

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:2328

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4D^38"
3⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:2384

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:928

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1044

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1016

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
3⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2192

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1484

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:876

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x17^38"
3⤵
PID:2940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1F^38"
3⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2600

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2688

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2624

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2664

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2920

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2528

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:2536

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2144

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:1908

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1564

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:2712

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4B^38"
3⤵
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x50^38"
3⤵
PID:2324

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:1996

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2372

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x52^38"
3⤵
PID:1304

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x08^38"
3⤵
PID:2368

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:1504

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1612

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:2240

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:1152

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2272

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x79^38"
3⤵
PID:484

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:632

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:1468

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
3⤵
PID:1132

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:1104

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:2296

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:948

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1840

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x13^38"
3⤵
PID:808

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1640

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2812

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2352

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2312

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:2424

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2964

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2552

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2756

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:1040

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x11^38"
3⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:1764

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:2732

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:2180

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:2492

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x10^38"
3⤵
PID:2484

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1E^38"
3⤵
PID:2924

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:352

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:2908

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x53^38"
3⤵
PID:1564

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x55^38"
3⤵
PID:2712

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x43^38"
3⤵
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x15^38"
3⤵
PID:1968

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x14^38"
3⤵
PID:2000

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:1296

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x1C^38"
3⤵
PID:2132

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x65^38"
3⤵
PID:1292

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x47^38"
3⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:2176

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4A^38"
3⤵
PID:1612

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x71^38"
3⤵
PID:2240

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1152

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x48^38"
3⤵
PID:2272

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x42^38"
3⤵
PID:484

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:812

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x51^38"
3⤵
PID:584

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x76^38"
3⤵
PID:612

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:984

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x49^38"
3⤵
PID:2332

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x45^38"
3⤵
PID:1316

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x67^38"
3⤵
PID:688

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0E^38"
3⤵
PID:928

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1044

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1016

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x54^38"
3⤵
PID:840

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x12^38"
3⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:340

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:1336

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:1724

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2940

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2620

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2596

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2480

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:1700

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2968

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2896

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0A^38"
3⤵
PID:760

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:1688

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x4F^38"
3⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x06^38"
3⤵
PID:2652

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x16^38"
3⤵
PID:2212

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x0F^38"
3⤵
PID:1028

C:\Windows\SysWOW64\cmd.exe
cmd /c set /a "0x5F^38"
3⤵
PID:1940

C:\Users\Admin\AppData\Local\Temp\Transferencia.exe
"C:\Users\Admin\AppData\Local\Temp\Transferencia.exe"
3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1512

C:\Windows\SysWOW64\dvdplay.exe
"C:\Windows\SysWOW64\dvdplay.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso2731.tmp\System.dll

Filesize
12KB

MD5
12b140583e3273ee1f65016becea58c4

SHA1
92df24d11797fefd2e1f8d29be9dfd67c56c1ada

SHA256
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

SHA512
49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

Download Submit
\Users\Admin\AppData\Local\Temp\nso2731.tmp\nsExec.dll

Filesize
6KB

MD5
4a2f4fe4a3ad1de56ee6bf7dd4923963

SHA1
7cc68b94448c964fd99904e5784b059aed4d5daa

SHA256
89b1e6509a1b45b32933e9d785a9c8c5b9ce7c616e1112dcf7fc3fa5ca27ebde

SHA512
4b6bbe75beafae9a29932ff5ddd3940aadfae62c157836e6cdab755955782dd5354d5eb389b4b8c16bf59f4ce7a099a0161d915c1cf2968f28e195dc8e3997ea

Download Submit
memory/1356-934-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/1356-937-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/1512-901-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1512-923-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1512-924-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1512-925-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1512-926-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1512-927-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1512-928-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1512-936-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads