Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 14:23
Static task
static1
Behavioral task
behavioral1
Sample
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
Resource
win7-20240419-en
General
-
Target
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
-
Size
235KB
-
MD5
edc793f85ad6e90c754a9f0799cc08e3
-
SHA1
c0a2e36283f9e20219b25dd4e15ec7dc73e7aa71
-
SHA256
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb
-
SHA512
653ffa9b5f36afc61804354d74faf0d15e0ff3db4209a4d688de9c49917966a095b56108da1948e5011b262abd910259977f428d80e407d48a6af07579a6058a
-
SSDEEP
6144:OGKCONo00JeBH3onZ2q5YUUexxgKR63u9i24NnPdI:OBCy0J+XQZ1xgKR63u9i24NnPG
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe -
Executes dropped EXE 4 IoCs
Processes:
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exepid process 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4612 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4244 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 3656 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exedescription pid process target process PID 2364 set thread context of 32 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 set thread context of 4812 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 set thread context of 3092 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 set thread context of 4612 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 set thread context of 4244 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 set thread context of 3656 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exedescription pid process Token: SeDebugPrivilege 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe Token: SeDebugPrivilege 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exedescription pid process target process PID 2364 wrote to memory of 32 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 32 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 32 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 32 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 32 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 32 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 32 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 32 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 4812 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 4812 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 4812 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 4812 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 4812 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 4812 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 4812 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 4812 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 3092 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 3092 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 3092 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 3092 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 3092 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 3092 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 3092 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 2364 wrote to memory of 3092 2364 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 32 wrote to memory of 1000 32 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 32 wrote to memory of 1000 32 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 32 wrote to memory of 1000 32 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4612 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4612 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4612 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4612 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4612 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4612 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4612 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4612 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4244 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4244 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4244 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4244 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4244 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4244 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4244 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 4244 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 3656 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 3656 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 3656 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 3656 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 3656 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 3656 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 3656 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 1000 wrote to memory of 3656 1000 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe PID 4812 wrote to memory of 3012 4812 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe schtasks.exe PID 4812 wrote to memory of 3012 4812 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe schtasks.exe PID 4812 wrote to memory of 3012 4812 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe"C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe"C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp39A9.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe2⤵PID:3092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe.logFilesize
522B
MD58334a471a4b492ece225b471b8ad2fc8
SHA11cb24640f32d23e8f7800bd0511b7b9c3011d992
SHA2565612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169
SHA51256ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36
-
C:\Users\Admin\AppData\Local\Temp\tmp39A9.tmpFilesize
1KB
MD5cdbd829e6cd46e8a747214e62d6b9ba6
SHA12cc952d146a50e6e37de320d56aee66f6e328f5a
SHA25615dc6821efb09ad1b196f9c36322e252c5ddc10e80ee0f3ee0134d74bfea9b8d
SHA51259c9d58b86c2584ec5341b50344c5ab9e5a8ddd4e71e6d96b56e8d3033e262666393d9c821de73197d5388bd2e8818cc798ff083b6e99959777fcdf73be794d2
-
C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeFilesize
235KB
MD5edc793f85ad6e90c754a9f0799cc08e3
SHA1c0a2e36283f9e20219b25dd4e15ec7dc73e7aa71
SHA2564d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb
SHA512653ffa9b5f36afc61804354d74faf0d15e0ff3db4209a4d688de9c49917966a095b56108da1948e5011b262abd910259977f428d80e407d48a6af07579a6058a
-
memory/32-7-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/32-28-0x00000000751F0000-0x00000000759A0000-memory.dmpFilesize
7.7MB
-
memory/32-13-0x00000000751F0000-0x00000000759A0000-memory.dmpFilesize
7.7MB
-
memory/2364-4-0x00000000051E0000-0x000000000521E000-memory.dmpFilesize
248KB
-
memory/2364-6-0x0000000005220000-0x0000000005226000-memory.dmpFilesize
24KB
-
memory/2364-5-0x0000000005580000-0x000000000561C000-memory.dmpFilesize
624KB
-
memory/2364-0-0x00000000751FE000-0x00000000751FF000-memory.dmpFilesize
4KB
-
memory/2364-15-0x00000000751F0000-0x00000000759A0000-memory.dmpFilesize
7.7MB
-
memory/2364-3-0x00000000751F0000-0x00000000759A0000-memory.dmpFilesize
7.7MB
-
memory/2364-2-0x0000000002D80000-0x0000000002D86000-memory.dmpFilesize
24KB
-
memory/2364-1-0x0000000000870000-0x00000000008B0000-memory.dmpFilesize
256KB
-
memory/3092-14-0x00000000751F0000-0x00000000759A0000-memory.dmpFilesize
7.7MB
-
memory/4812-16-0x00000000751F0000-0x00000000759A0000-memory.dmpFilesize
7.7MB
-
memory/4812-17-0x00000000751F0000-0x00000000759A0000-memory.dmpFilesize
7.7MB
-
memory/4812-35-0x00000000751F0000-0x00000000759A0000-memory.dmpFilesize
7.7MB