Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 10:52
Behavioral task
behavioral1
Sample
23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe
Resource
win7-20240221-en
General
-
Target
23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe
-
Size
5.9MB
-
MD5
5e0b876ee31988e175db3148e32da910
-
SHA1
22a4ca03ae4df75b89c80a281c766b129772032f
-
SHA256
23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440
-
SHA512
0f26ba3118f8ccde86f8210d6c89a6acc0b640a9ec70b86d76038787640ffab236ced44c03f30628bcfa6f3de5987fab8de0e7c8826e6b48445c44487ecaab10
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x000b000000014e5a-3.dat cobalt_reflective_dll behavioral1/files/0x0031000000015b13-8.dat cobalt_reflective_dll behavioral1/files/0x0007000000015c7c-18.dat cobalt_reflective_dll behavioral1/files/0x0007000000015c9c-33.dat cobalt_reflective_dll behavioral1/files/0x0007000000015c86-28.dat cobalt_reflective_dll behavioral1/files/0x0008000000015ca5-40.dat cobalt_reflective_dll behavioral1/files/0x0008000000015cad-44.dat cobalt_reflective_dll behavioral1/files/0x0031000000015b77-54.dat cobalt_reflective_dll behavioral1/files/0x00070000000160f8-61.dat cobalt_reflective_dll behavioral1/files/0x0006000000016525-79.dat cobalt_reflective_dll behavioral1/files/0x0006000000016411-68.dat cobalt_reflective_dll behavioral1/files/0x00060000000167ef-91.dat cobalt_reflective_dll behavioral1/files/0x0006000000016597-84.dat cobalt_reflective_dll behavioral1/files/0x0006000000016c26-117.dat cobalt_reflective_dll behavioral1/files/0x0006000000016cc9-135.dat cobalt_reflective_dll behavioral1/files/0x0006000000016c7a-127.dat cobalt_reflective_dll behavioral1/files/0x0006000000016cab-132.dat cobalt_reflective_dll behavioral1/files/0x0006000000016c2e-122.dat cobalt_reflective_dll behavioral1/files/0x0006000000016c17-112.dat cobalt_reflective_dll behavioral1/files/0x0006000000016a45-105.dat cobalt_reflective_dll behavioral1/files/0x0006000000016277-71.dat cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
XMRig Miner payload 58 IoCs
resource yara_rule behavioral1/memory/2992-0-0x000000013FBD0000-0x000000013FF24000-memory.dmp xmrig behavioral1/files/0x000b000000014e5a-3.dat xmrig behavioral1/memory/2744-12-0x000000013F390000-0x000000013F6E4000-memory.dmp xmrig behavioral1/files/0x0031000000015b13-8.dat xmrig behavioral1/memory/1672-20-0x000000013F150000-0x000000013F4A4000-memory.dmp xmrig behavioral1/memory/2516-23-0x000000013FFE0000-0x0000000140334000-memory.dmp xmrig behavioral1/files/0x0007000000015c7c-18.dat xmrig behavioral1/files/0x0007000000015c9c-33.dat xmrig behavioral1/files/0x0007000000015c86-28.dat xmrig behavioral1/memory/2052-37-0x000000013FD00000-0x0000000140054000-memory.dmp xmrig behavioral1/files/0x0008000000015ca5-40.dat xmrig behavioral1/memory/2732-43-0x000000013F0F0000-0x000000013F444000-memory.dmp xmrig behavioral1/files/0x0008000000015cad-44.dat xmrig behavioral1/memory/2560-36-0x000000013F480000-0x000000013F7D4000-memory.dmp xmrig behavioral1/memory/2180-50-0x000000013FA50000-0x000000013FDA4000-memory.dmp xmrig behavioral1/files/0x0031000000015b77-54.dat xmrig behavioral1/memory/2412-58-0x000000013FA20000-0x000000013FD74000-memory.dmp xmrig behavioral1/files/0x00070000000160f8-61.dat xmrig behavioral1/files/0x0006000000016525-79.dat xmrig behavioral1/files/0x0006000000016411-68.dat xmrig behavioral1/files/0x00060000000167ef-91.dat xmrig behavioral1/memory/2796-98-0x000000013F200000-0x000000013F554000-memory.dmp xmrig behavioral1/memory/2964-99-0x000000013FFF0000-0x0000000140344000-memory.dmp xmrig behavioral1/memory/2768-102-0x000000013F940000-0x000000013FC94000-memory.dmp xmrig behavioral1/files/0x0006000000016597-84.dat xmrig behavioral1/files/0x0006000000016c26-117.dat xmrig behavioral1/files/0x0006000000016cc9-135.dat xmrig behavioral1/files/0x0006000000016c7a-127.dat xmrig behavioral1/files/0x0006000000016cab-132.dat xmrig behavioral1/files/0x0006000000016c2e-122.dat xmrig behavioral1/files/0x0006000000016c17-112.dat xmrig behavioral1/memory/2732-107-0x000000013F0F0000-0x000000013F444000-memory.dmp xmrig behavioral1/files/0x0006000000016a45-105.dat xmrig behavioral1/memory/2500-92-0x000000013FFD0000-0x0000000140324000-memory.dmp xmrig behavioral1/memory/2348-73-0x000000013F450000-0x000000013F7A4000-memory.dmp xmrig behavioral1/memory/2488-72-0x000000013F410000-0x000000013F764000-memory.dmp xmrig behavioral1/files/0x0006000000016277-71.dat xmrig behavioral1/memory/2992-83-0x000000013FFF0000-0x0000000140344000-memory.dmp xmrig behavioral1/memory/1672-81-0x000000013F150000-0x000000013F4A4000-memory.dmp xmrig behavioral1/memory/2744-80-0x000000013F390000-0x000000013F6E4000-memory.dmp xmrig behavioral1/memory/2992-78-0x000000013FBD0000-0x000000013FF24000-memory.dmp xmrig behavioral1/memory/2180-139-0x000000013FA50000-0x000000013FDA4000-memory.dmp xmrig behavioral1/memory/2348-141-0x000000013F450000-0x000000013F7A4000-memory.dmp xmrig behavioral1/memory/2992-142-0x000000013F450000-0x000000013F7A4000-memory.dmp xmrig behavioral1/memory/2744-146-0x000000013F390000-0x000000013F6E4000-memory.dmp xmrig behavioral1/memory/1672-147-0x000000013F150000-0x000000013F4A4000-memory.dmp xmrig behavioral1/memory/2516-148-0x000000013FFE0000-0x0000000140334000-memory.dmp xmrig behavioral1/memory/2560-149-0x000000013F480000-0x000000013F7D4000-memory.dmp xmrig behavioral1/memory/2052-150-0x000000013FD00000-0x0000000140054000-memory.dmp xmrig behavioral1/memory/2732-151-0x000000013F0F0000-0x000000013F444000-memory.dmp xmrig behavioral1/memory/2412-152-0x000000013FA20000-0x000000013FD74000-memory.dmp xmrig behavioral1/memory/2180-153-0x000000013FA50000-0x000000013FDA4000-memory.dmp xmrig behavioral1/memory/2488-154-0x000000013F410000-0x000000013F764000-memory.dmp xmrig behavioral1/memory/2348-155-0x000000013F450000-0x000000013F7A4000-memory.dmp xmrig behavioral1/memory/2500-156-0x000000013FFD0000-0x0000000140324000-memory.dmp xmrig behavioral1/memory/2796-157-0x000000013F200000-0x000000013F554000-memory.dmp xmrig behavioral1/memory/2964-158-0x000000013FFF0000-0x0000000140344000-memory.dmp xmrig behavioral1/memory/2768-159-0x000000013F940000-0x000000013FC94000-memory.dmp xmrig -
Executes dropped EXE 21 IoCs
pid Process 2744 yRZzJec.exe 1672 dgDgdSA.exe 2516 JMWENSU.exe 2560 XXtTbeQ.exe 2052 AoNonUA.exe 2732 RkpNSiQ.exe 2180 TiRRHih.exe 2412 gwqstOX.exe 2488 gpBwLLZ.exe 2348 EbjcAbz.exe 2500 ZNEFyjs.exe 2796 ocCsezt.exe 2964 WMBnoxJ.exe 2768 pxYHHSS.exe 780 DkDjHcF.exe 960 GzWKphx.exe 2912 neRqQfJ.exe 1888 MRbPtoR.exe 1276 ynedWxm.exe 1376 ejjogEX.exe 2088 lkYPxCR.exe -
Loads dropped DLL 21 IoCs
pid Process 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe -
resource yara_rule behavioral1/memory/2992-0-0x000000013FBD0000-0x000000013FF24000-memory.dmp upx behavioral1/files/0x000b000000014e5a-3.dat upx behavioral1/memory/2744-12-0x000000013F390000-0x000000013F6E4000-memory.dmp upx behavioral1/files/0x0031000000015b13-8.dat upx behavioral1/memory/1672-20-0x000000013F150000-0x000000013F4A4000-memory.dmp upx behavioral1/memory/2516-23-0x000000013FFE0000-0x0000000140334000-memory.dmp upx behavioral1/files/0x0007000000015c7c-18.dat upx behavioral1/files/0x0007000000015c9c-33.dat upx behavioral1/files/0x0007000000015c86-28.dat upx behavioral1/memory/2052-37-0x000000013FD00000-0x0000000140054000-memory.dmp upx behavioral1/files/0x0008000000015ca5-40.dat upx behavioral1/memory/2732-43-0x000000013F0F0000-0x000000013F444000-memory.dmp upx behavioral1/files/0x0008000000015cad-44.dat upx behavioral1/memory/2560-36-0x000000013F480000-0x000000013F7D4000-memory.dmp upx behavioral1/memory/2180-50-0x000000013FA50000-0x000000013FDA4000-memory.dmp upx behavioral1/files/0x0031000000015b77-54.dat upx behavioral1/memory/2412-58-0x000000013FA20000-0x000000013FD74000-memory.dmp upx behavioral1/files/0x00070000000160f8-61.dat upx behavioral1/files/0x0006000000016525-79.dat upx behavioral1/files/0x0006000000016411-68.dat upx behavioral1/files/0x00060000000167ef-91.dat upx behavioral1/memory/2796-98-0x000000013F200000-0x000000013F554000-memory.dmp upx behavioral1/memory/2964-99-0x000000013FFF0000-0x0000000140344000-memory.dmp upx behavioral1/memory/2768-102-0x000000013F940000-0x000000013FC94000-memory.dmp upx behavioral1/files/0x0006000000016597-84.dat upx behavioral1/files/0x0006000000016c26-117.dat upx behavioral1/files/0x0006000000016cc9-135.dat upx behavioral1/files/0x0006000000016c7a-127.dat upx behavioral1/files/0x0006000000016cab-132.dat upx behavioral1/files/0x0006000000016c2e-122.dat upx behavioral1/files/0x0006000000016c17-112.dat upx behavioral1/memory/2732-107-0x000000013F0F0000-0x000000013F444000-memory.dmp upx behavioral1/files/0x0006000000016a45-105.dat upx behavioral1/memory/2500-92-0x000000013FFD0000-0x0000000140324000-memory.dmp upx behavioral1/memory/2348-73-0x000000013F450000-0x000000013F7A4000-memory.dmp upx behavioral1/memory/2488-72-0x000000013F410000-0x000000013F764000-memory.dmp upx behavioral1/files/0x0006000000016277-71.dat upx behavioral1/memory/1672-81-0x000000013F150000-0x000000013F4A4000-memory.dmp upx behavioral1/memory/2744-80-0x000000013F390000-0x000000013F6E4000-memory.dmp upx behavioral1/memory/2992-78-0x000000013FBD0000-0x000000013FF24000-memory.dmp upx behavioral1/memory/2180-139-0x000000013FA50000-0x000000013FDA4000-memory.dmp upx behavioral1/memory/2348-141-0x000000013F450000-0x000000013F7A4000-memory.dmp upx behavioral1/memory/2744-146-0x000000013F390000-0x000000013F6E4000-memory.dmp upx behavioral1/memory/1672-147-0x000000013F150000-0x000000013F4A4000-memory.dmp upx behavioral1/memory/2516-148-0x000000013FFE0000-0x0000000140334000-memory.dmp upx behavioral1/memory/2560-149-0x000000013F480000-0x000000013F7D4000-memory.dmp upx behavioral1/memory/2052-150-0x000000013FD00000-0x0000000140054000-memory.dmp upx behavioral1/memory/2732-151-0x000000013F0F0000-0x000000013F444000-memory.dmp upx behavioral1/memory/2412-152-0x000000013FA20000-0x000000013FD74000-memory.dmp upx behavioral1/memory/2180-153-0x000000013FA50000-0x000000013FDA4000-memory.dmp upx behavioral1/memory/2488-154-0x000000013F410000-0x000000013F764000-memory.dmp upx behavioral1/memory/2348-155-0x000000013F450000-0x000000013F7A4000-memory.dmp upx behavioral1/memory/2500-156-0x000000013FFD0000-0x0000000140324000-memory.dmp upx behavioral1/memory/2796-157-0x000000013F200000-0x000000013F554000-memory.dmp upx behavioral1/memory/2964-158-0x000000013FFF0000-0x0000000140344000-memory.dmp upx behavioral1/memory/2768-159-0x000000013F940000-0x000000013FC94000-memory.dmp upx -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\AoNonUA.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\gpBwLLZ.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\ZNEFyjs.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\GzWKphx.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\lkYPxCR.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\dgDgdSA.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\JMWENSU.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\ocCsezt.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\neRqQfJ.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\MRbPtoR.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\ynedWxm.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\yRZzJec.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\XXtTbeQ.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\RkpNSiQ.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\TiRRHih.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\EbjcAbz.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\DkDjHcF.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\gwqstOX.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\WMBnoxJ.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\pxYHHSS.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe File created C:\Windows\System\ejjogEX.exe 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe Token: SeLockMemoryPrivilege 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2992 wrote to memory of 2744 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 29 PID 2992 wrote to memory of 2744 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 29 PID 2992 wrote to memory of 2744 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 29 PID 2992 wrote to memory of 1672 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 30 PID 2992 wrote to memory of 1672 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 30 PID 2992 wrote to memory of 1672 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 30 PID 2992 wrote to memory of 2516 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 31 PID 2992 wrote to memory of 2516 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 31 PID 2992 wrote to memory of 2516 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 31 PID 2992 wrote to memory of 2560 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 32 PID 2992 wrote to memory of 2560 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 32 PID 2992 wrote to memory of 2560 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 32 PID 2992 wrote to memory of 2052 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 33 PID 2992 wrote to memory of 2052 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 33 PID 2992 wrote to memory of 2052 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 33 PID 2992 wrote to memory of 2732 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 34 PID 2992 wrote to memory of 2732 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 34 PID 2992 wrote to memory of 2732 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 34 PID 2992 wrote to memory of 2180 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 35 PID 2992 wrote to memory of 2180 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 35 PID 2992 wrote to memory of 2180 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 35 PID 2992 wrote to memory of 2412 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 36 PID 2992 wrote to memory of 2412 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 36 PID 2992 wrote to memory of 2412 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 36 PID 2992 wrote to memory of 2488 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 37 PID 2992 wrote to memory of 2488 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 37 PID 2992 wrote to memory of 2488 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 37 PID 2992 wrote to memory of 2348 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 38 PID 2992 wrote to memory of 2348 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 38 PID 2992 wrote to memory of 2348 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 38 PID 2992 wrote to memory of 2964 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 39 PID 2992 wrote to memory of 2964 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 39 PID 2992 wrote to memory of 2964 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 39 PID 2992 wrote to memory of 2500 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 40 PID 2992 wrote to memory of 2500 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 40 PID 2992 wrote to memory of 2500 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 40 PID 2992 wrote to memory of 2768 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 41 PID 2992 wrote to memory of 2768 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 41 PID 2992 wrote to memory of 2768 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 41 PID 2992 wrote to memory of 2796 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 42 PID 2992 wrote to memory of 2796 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 42 PID 2992 wrote to memory of 2796 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 42 PID 2992 wrote to memory of 780 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 43 PID 2992 wrote to memory of 780 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 43 PID 2992 wrote to memory of 780 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 43 PID 2992 wrote to memory of 960 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 44 PID 2992 wrote to memory of 960 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 44 PID 2992 wrote to memory of 960 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 44 PID 2992 wrote to memory of 2912 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 45 PID 2992 wrote to memory of 2912 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 45 PID 2992 wrote to memory of 2912 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 45 PID 2992 wrote to memory of 1888 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 46 PID 2992 wrote to memory of 1888 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 46 PID 2992 wrote to memory of 1888 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 46 PID 2992 wrote to memory of 1276 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 47 PID 2992 wrote to memory of 1276 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 47 PID 2992 wrote to memory of 1276 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 47 PID 2992 wrote to memory of 1376 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 48 PID 2992 wrote to memory of 1376 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 48 PID 2992 wrote to memory of 1376 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 48 PID 2992 wrote to memory of 2088 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 49 PID 2992 wrote to memory of 2088 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 49 PID 2992 wrote to memory of 2088 2992 23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe"C:\Users\Admin\AppData\Local\Temp\23ba6ac978148bff5f316f18090e2dce81f9827d52d2aedf128990191b321440.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\System\yRZzJec.exeC:\Windows\System\yRZzJec.exe2⤵
- Executes dropped EXE
PID:2744
-
-
C:\Windows\System\dgDgdSA.exeC:\Windows\System\dgDgdSA.exe2⤵
- Executes dropped EXE
PID:1672
-
-
C:\Windows\System\JMWENSU.exeC:\Windows\System\JMWENSU.exe2⤵
- Executes dropped EXE
PID:2516
-
-
C:\Windows\System\XXtTbeQ.exeC:\Windows\System\XXtTbeQ.exe2⤵
- Executes dropped EXE
PID:2560
-
-
C:\Windows\System\AoNonUA.exeC:\Windows\System\AoNonUA.exe2⤵
- Executes dropped EXE
PID:2052
-
-
C:\Windows\System\RkpNSiQ.exeC:\Windows\System\RkpNSiQ.exe2⤵
- Executes dropped EXE
PID:2732
-
-
C:\Windows\System\TiRRHih.exeC:\Windows\System\TiRRHih.exe2⤵
- Executes dropped EXE
PID:2180
-
-
C:\Windows\System\gwqstOX.exeC:\Windows\System\gwqstOX.exe2⤵
- Executes dropped EXE
PID:2412
-
-
C:\Windows\System\gpBwLLZ.exeC:\Windows\System\gpBwLLZ.exe2⤵
- Executes dropped EXE
PID:2488
-
-
C:\Windows\System\EbjcAbz.exeC:\Windows\System\EbjcAbz.exe2⤵
- Executes dropped EXE
PID:2348
-
-
C:\Windows\System\WMBnoxJ.exeC:\Windows\System\WMBnoxJ.exe2⤵
- Executes dropped EXE
PID:2964
-
-
C:\Windows\System\ZNEFyjs.exeC:\Windows\System\ZNEFyjs.exe2⤵
- Executes dropped EXE
PID:2500
-
-
C:\Windows\System\pxYHHSS.exeC:\Windows\System\pxYHHSS.exe2⤵
- Executes dropped EXE
PID:2768
-
-
C:\Windows\System\ocCsezt.exeC:\Windows\System\ocCsezt.exe2⤵
- Executes dropped EXE
PID:2796
-
-
C:\Windows\System\DkDjHcF.exeC:\Windows\System\DkDjHcF.exe2⤵
- Executes dropped EXE
PID:780
-
-
C:\Windows\System\GzWKphx.exeC:\Windows\System\GzWKphx.exe2⤵
- Executes dropped EXE
PID:960
-
-
C:\Windows\System\neRqQfJ.exeC:\Windows\System\neRqQfJ.exe2⤵
- Executes dropped EXE
PID:2912
-
-
C:\Windows\System\MRbPtoR.exeC:\Windows\System\MRbPtoR.exe2⤵
- Executes dropped EXE
PID:1888
-
-
C:\Windows\System\ynedWxm.exeC:\Windows\System\ynedWxm.exe2⤵
- Executes dropped EXE
PID:1276
-
-
C:\Windows\System\ejjogEX.exeC:\Windows\System\ejjogEX.exe2⤵
- Executes dropped EXE
PID:1376
-
-
C:\Windows\System\lkYPxCR.exeC:\Windows\System\lkYPxCR.exe2⤵
- Executes dropped EXE
PID:2088
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d3107a176efc35cdd7c20678fe847069
SHA15aaf9065bc63ee549bc68a434b9d110393570e5c
SHA25646971a2a6518ad38b6cff2ef44d9a2c5f2992f16fe093b5f857f23d0fc819b40
SHA51250b2ac3008024e08fe9f4fb2213314f498efa5ec61e3a5843a0931c175be302ec58b66df7828e5fecea0fae1ebac16e0f9c980a7344294fb50d9fd544f261156
-
Filesize
5.9MB
MD53a00c0db8cbe056b8b2832906222a054
SHA14efcb2f2606d0bd053b5a64450ecab1915e7b0be
SHA256d752a1242ae3dc17f3fc5db43d70c1c33b1386e0068e9f2e6e5977dfb9eb8340
SHA512d3db3b481968a9e39938204b061802a38ec17a7fd27fb5f06b89725f49ef2ac4ae5a43cdf358cbce21b26b334bb212259de77c882e0b66624d271401c0e4d8b7
-
Filesize
5.9MB
MD5a70102ec232d62a4e5d530f7bfa2076f
SHA1bb311824beaf55ba25e111f6926d2c33230ec38d
SHA2561ea6fe14c3b594d55659059c203f9a38301094bd82ad5255948a93c74cfe38fb
SHA51203b1e6204702390803406ffc1a90613ed3aad0e361a082a99abd6b05c565c04be1ea3a2f85b0718b6027eee63229d8ee1996783b01ae2cd78442ff743d884cc0
-
Filesize
5.9MB
MD5043bf88849c1ca33610bc9c723336a46
SHA1ea0707788b0825beb8daa12f4c3d42f8bd13c65e
SHA256d432e4abef6d322df214c939d12573ba2b944048cebc578adbd5d4f68886350c
SHA51257f6ee88cf7d4fc1f39377234bc963bfd3ddfbd88ecaafa790bead996a760a88d8cc651682ec57846a70abaa84018eb2cd8e7470450619debd4a4cbaf7a6ffc9
-
Filesize
5.9MB
MD506a7f5affb8bc6fd518b2c8f7904fd78
SHA1dd4033f107035089ab251bf49b6a7d09d117906b
SHA25644230aa2f8e5946f9b0416fecbfa4952bddb78e15808db73409e9654fb9e001a
SHA512a7dc42d476f6ddf079e76466495f328a3c64d01eaaff6c7c34a53e76bf3aea1858c7e861e6e88eb92584672baea3afc3acef93fab7f835cc7f297aa057b772e7
-
Filesize
5.9MB
MD51c655a4a023c2ccb0dbd6d2b191838d5
SHA131882d1e2604f9a7c2990e4b04d44921ad6c779a
SHA256dac7226e88641776ca1b214f074f98cba438feae2c1a5b6ea26a539bbf567a31
SHA512370420f0d2689835f082432e8d15847e731f97bf7ab85a53429000f8af243b73f034661e21a745791640f44956d4d821816026a4922ed14f1eac1077fb85ceed
-
Filesize
5.9MB
MD59d159c145fab5efbd9340a6dc3c6ed83
SHA1cd9825ce9a89d0c7c9abf662dbdc7d264403e1ff
SHA25610e729a8b3da632e035a3791a49bdff4499459d57a2502cb1c1e8726f8bae816
SHA5124b01532b3aab127ae4feb3873b84464c76d992d425db0d1b46d10dab7f469743a72c66fed9ae62bfba06316cc05727db926f77aa8d404503f20a7a916a502c20
-
Filesize
5.9MB
MD50938ebf13b20bce1e6dfdab5a729a9e4
SHA108080df36daa167dc399c8fff6a4852be7c8962a
SHA25612802c190afad9b3c78d615a3fc896edf8c8489c62a909bbb7dd0de88c1a2598
SHA512c3e5a1cb82bfaab588a00aadcd54df45be2045a886a73c4342ecb865d0d1e7579b0c487001f2b0ae033dfaba090a77d206d3bc930669bd348d5004236cccf19d
-
Filesize
5.9MB
MD539d06624bf44919bf996e4e5260d0d83
SHA1e5a68a7994456e40a6ab3981407dc98306f661fb
SHA2562d017101624fc0878e036c27a98471b55b17a735f66a18e598d69d9d22cd93f5
SHA512c37edbcfdc0428f7e3514d21fd240e857e1df453196788a5abf8fd9a87a2b515d51b4a024d7c1cde41e8eb7e47d6451611d39a238775573474acbb6fd60d14c3
-
Filesize
5.9MB
MD5e4dfeccb9fd5f9a3f600d75cff13bbc3
SHA1b49f0eef7bf17e33eb8942fff0d50857ad391f13
SHA2563c5ea29c21507da65c4f68361c66681026ea8af20f49789c36deba350f58c8aa
SHA512dc7d064d79f35994dee56f3be72001bbe23e99549e6bdc19d7d2f66486b1181d723206a25c61e43f8d7f2c9ae2aafa2b302062ae7e5a5794c60730dfe2ef41f3
-
Filesize
5.9MB
MD5676423e676c585dd6185e9c19b35bb5e
SHA1ca47408867306f94157da123470f7dd4014111d4
SHA256c12e6d29698cb398c9ebea89c4b5d0263fdf1f4bf243d95a9fc6a94d16848ffe
SHA51289e71b7826d4f93ed3a5efd8e606208484109c3eb0a8169a2960ae99876694073618beace5a8fce04b9106102eb68ade25103704cb4d0b31b57e92688c913fd6
-
Filesize
5.9MB
MD590230edf8f061e1a7c58ae45a1940164
SHA18f951ce7d02c619797e6330b16c81c0995de697b
SHA2562bd1905320b6f41dd0ca0706502775714cc546a37741e70a343c08a0e42d47e3
SHA5122ad1a667a87bfd49893a23817b79dc176f60a706a18486c318ef63d08c5e421220c55c2b77c45461b648fa5889b3843be691f8f4fb700555cdfb40a5ff26ae92
-
Filesize
5.9MB
MD55319cf9b986fad304e4163801baf3220
SHA1b654b3c1af6f71663b02c3960171388b38dd46bb
SHA256e67a19d36f998611941ac9a21380b492a327a6100797ec8ea0ffe8af5f9f2145
SHA51204803d63affd28202f05ea55617427dc0db95294e1ec1e2e79867676d0020c24b3644b1c3bb9303a0782431719626179d8ea430269b1d7c3ec6814fc17c7e907
-
Filesize
5.9MB
MD5e088626f31c13529dd163b2052d131f3
SHA1445a0367285fe6190d46fd9d4ab2672a183a0401
SHA256207da1b3e6e8f208dfda9b4e8680cfda8c02fb52705809075d474d840bc0bbb5
SHA5124c9e1c7d71317c1db30963239db837a3efba59fa6f0d1369be744853069d366ed3ae61318622f39ff8c22435894b903a1aa580f02807093546a51a6af9e0995a
-
Filesize
5.9MB
MD5bdf78cc522e0ec804b1d65a6c5bb6fef
SHA173db21d11b8af9e4461a24bab5d7206a81b5143d
SHA25646c50ce26c817de3eb2d2389f5a116e097dba52dda5c64cc9fc9fd3297539c33
SHA512703f7bf9ddc08a9cb09fbb10693c348f55258a72e2fa09b2f5e08962f6e8b7e7b65100b5c356c37c8379957f32c57ec3a443e34cb981cdd4b80fb6faa4d73c40
-
Filesize
5.9MB
MD586914fa48ddf2e12bc084bc7b58cc42d
SHA1330c2bd28823c1039945370aae0f5cc38a001de1
SHA256ac5e804cce8cdaeda5c626259e5a50496c686d8a8311cb959fbb6687ee9b57b0
SHA512c4aba3b595ce8f68a868a23651f852b1494c1599a0c1e5d177c8caa953f8df7f9bc3764c81d4f0ca6fb46c10e431aa23deb5edd26ab9b11a34c80bb92566c88d
-
Filesize
5.9MB
MD5564d3b2ce2b157d1a40ad6a2403316f9
SHA1f45fad8224bdc76660b6bcdfa313fbbcce356159
SHA2569ea832006582c5fa3eb0fcd560de4808ee74042b2272c134dee44f35f76aa516
SHA512056fb780cc4f430b8dbb22fc1f3d2afc5fc7cd45c4b987416ddb72cc732e407c1f5e863c520a3815a95b6ac29acef098a5747df3add32d74237da8c550758066
-
Filesize
5.9MB
MD5323c3a05ba4b02ec816cbbb7cdbe872d
SHA15a38200edcd2db8072d920536478ed89e34be5c1
SHA2563bbd263940b542e87452ae4a2d3eda43123ee5253ea7ed39fb14856e83b47399
SHA512b83d08c87d212080b60d9b11e3af6e0e3b78133dcd4addd3a925d09e86c0b051d1a27d6611e553e641fe7134574ce1cc0951e114c5435179b5f2ec745b79f131
-
Filesize
5.9MB
MD5752d2e5ca68812990a9de6c2249a9509
SHA17a9748936daaf3c4b57c416121bfe5430d5859fc
SHA2565ee9a2613e693b7155050faf57f19ece65b944abe6a928d77c0273750e922380
SHA5122d005c0721a97f90d3093cec042ac0b2aaea23963f57ff6fb182c324373830f5dd400877e9804c870ef4578df170d49a1b71bd06b0604043d5a056948a04e8fd
-
Filesize
5.9MB
MD5bd3b29959b85e10a2b4eb76b4f325d61
SHA15533e883dec61c6257c4cb4ffa8ad51ef564a1e2
SHA2562aed87feafc5b0424fe99575bd442c4f2b6e048244b35fd7c0eea069c281f949
SHA51220934b900b9e91b5da267421b2cb84bc25d421e0d250f3d088983f400f3d98f1730d2050826db2e8972b60ab94d5fe608ff7345e07617efb36436fab0ce9f0c5
-
Filesize
5.9MB
MD59e47baf931f9358473538b66b1c878e2
SHA1bd1aea966f4690ab44389db2bc150165e4c28386
SHA256b277d8946d760981a07083ff4cc0ea4e12821c63c63161bb15b332bd6afab9f2
SHA5127794bb54705cfcd45170eb652511af337a5c84a9a9b82d3abf18ed802f4f6f9d36473cb722f1c2e25f67de0f19f68e6dad831154d280152106e975e3356d5dfe