Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/09/2024, 23:05
Behavioral task
behavioral1
Sample
86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe
Resource
win10v2004-20240802-en
General
-
Target
86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe
-
Size
4.9MB
-
MD5
32015ffa59e656dea9ca43bc953655f5
-
SHA1
dc2d352d93c7d5baf01caa82be5ab07f0a472dc2
-
SHA256
86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8
-
SHA512
502eca2738943139cb57e884b862aadd052940fe4900ffd46f60f735273bb02a74d51b33dbc6e2a89765be3b4234f47f3056fddb13651f27f7ec77ec943148be
-
SSDEEP
98304:6ikaW9Vf1T25iCHZWqqVN9iUf4B7iHw3EItOOaQ1+5PxPU:/8hC53q79iz779U5+
Malware Config
Extracted
gozi
Signatures
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral2/memory/2520-3-0x0000000010000000-0x0000000010024000-memory.dmp family_blackmoon -
resource yara_rule behavioral2/memory/2520-3-0x0000000010000000-0x0000000010024000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 4124 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 82 PID 2520 wrote to memory of 4124 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 82 PID 2520 wrote to memory of 4124 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 82 PID 4124 wrote to memory of 2896 4124 cmd.exe 84 PID 4124 wrote to memory of 2896 4124 cmd.exe 84 PID 4124 wrote to memory of 2896 4124 cmd.exe 84 PID 2520 wrote to memory of 3984 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 85 PID 2520 wrote to memory of 3984 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 85 PID 2520 wrote to memory of 3984 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 85 PID 3984 wrote to memory of 4864 3984 cmd.exe 87 PID 3984 wrote to memory of 4864 3984 cmd.exe 87 PID 3984 wrote to memory of 4864 3984 cmd.exe 87 PID 2520 wrote to memory of 668 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 88 PID 2520 wrote to memory of 668 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 88 PID 2520 wrote to memory of 668 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 88 PID 668 wrote to memory of 2420 668 cmd.exe 90 PID 668 wrote to memory of 2420 668 cmd.exe 90 PID 668 wrote to memory of 2420 668 cmd.exe 90 PID 2520 wrote to memory of 1100 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 91 PID 2520 wrote to memory of 1100 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 91 PID 2520 wrote to memory of 1100 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 91 PID 1100 wrote to memory of 3492 1100 cmd.exe 93 PID 1100 wrote to memory of 3492 1100 cmd.exe 93 PID 1100 wrote to memory of 3492 1100 cmd.exe 93 PID 2520 wrote to memory of 4388 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 94 PID 2520 wrote to memory of 4388 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 94 PID 2520 wrote to memory of 4388 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 94 PID 4388 wrote to memory of 2952 4388 cmd.exe 96 PID 4388 wrote to memory of 2952 4388 cmd.exe 96 PID 4388 wrote to memory of 2952 4388 cmd.exe 96 PID 2520 wrote to memory of 612 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 97 PID 2520 wrote to memory of 612 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 97 PID 2520 wrote to memory of 612 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 97 PID 612 wrote to memory of 3948 612 cmd.exe 99 PID 612 wrote to memory of 3948 612 cmd.exe 99 PID 612 wrote to memory of 3948 612 cmd.exe 99 PID 2520 wrote to memory of 464 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 101 PID 2520 wrote to memory of 464 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 101 PID 2520 wrote to memory of 464 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 101 PID 464 wrote to memory of 4892 464 cmd.exe 104 PID 464 wrote to memory of 4892 464 cmd.exe 104 PID 464 wrote to memory of 4892 464 cmd.exe 104 PID 2520 wrote to memory of 4988 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 105 PID 2520 wrote to memory of 4988 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 105 PID 2520 wrote to memory of 4988 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 105 PID 4988 wrote to memory of 4360 4988 cmd.exe 107 PID 4988 wrote to memory of 4360 4988 cmd.exe 107 PID 4988 wrote to memory of 4360 4988 cmd.exe 107 PID 2520 wrote to memory of 4972 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 108 PID 2520 wrote to memory of 4972 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 108 PID 2520 wrote to memory of 4972 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 108 PID 4972 wrote to memory of 2556 4972 cmd.exe 110 PID 4972 wrote to memory of 2556 4972 cmd.exe 110 PID 4972 wrote to memory of 2556 4972 cmd.exe 110 PID 2520 wrote to memory of 1764 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 111 PID 2520 wrote to memory of 1764 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 111 PID 2520 wrote to memory of 1764 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 111 PID 1764 wrote to memory of 456 1764 cmd.exe 113 PID 1764 wrote to memory of 456 1764 cmd.exe 113 PID 1764 wrote to memory of 456 1764 cmd.exe 113 PID 2520 wrote to memory of 536 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 116 PID 2520 wrote to memory of 536 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 116 PID 2520 wrote to memory of 536 2520 86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe 116 PID 536 wrote to memory of 3588 536 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe"C:\Users\Admin\AppData\Local\Temp\86e21c5781de913e5a17fa9b7633c82f9669281ade7ab2aff0dba05d134468b8.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 142.171.156.372⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 142.171.156.373⤵PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 142.171.156.382⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 142.171.156.383⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4864
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 107.173.181.102⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 107.173.181.103⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2420
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 172.245.81.1832⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 172.245.81.1833⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3492
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 119.23.226.2422⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 119.23.226.2423⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2952
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 107.173.164.862⤵
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 107.173.164.863⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3948
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 142.171.156.352⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 142.171.156.353⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4892
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 142.171.156.362⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 142.171.156.363⤵
- System Location Discovery: System Language Discovery
PID:4360
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 104.168.13.1302⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 104.168.13.1303⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2556
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 107.148.43.2342⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 107.148.43.2343⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:456
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 23.94.59.1952⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 23.94.59.1953⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3588
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 198.46.235.162⤵
- System Location Discovery: System Language Discovery
PID:4076 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 198.46.235.163⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2620
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 119.23.226.2422⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 119.23.226.2423⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4492
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 172.245.79.532⤵
- System Location Discovery: System Language Discovery
PID:4252 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 172.245.79.533⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2228
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 142.171.156.382⤵
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 142.171.156.383⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1292
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 119.23.231.1532⤵PID:3496
-
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 119.23.231.1533⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1608
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 45.248.11.1182⤵
- System Location Discovery: System Language Discovery
PID:640 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 45.248.11.1183⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4288
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 198.46.251.1792⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 198.46.251.1793⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1408
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 107.174.67.1852⤵
- System Location Discovery: System Language Discovery
PID:412 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 107.174.67.1853⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2276
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 101.37.166.1832⤵
- System Location Discovery: System Language Discovery
PID:1472 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 101.37.166.1833⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2552
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 23.94.122.2072⤵
- System Location Discovery: System Language Discovery
PID:1768 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 23.94.122.2073⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1612
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 107.174.66.1812⤵
- System Location Discovery: System Language Discovery
PID:5044 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 107.174.66.1813⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4380
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 8.141.85.572⤵PID:2488
-
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 8.141.85.573⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1892
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 8.141.95.1462⤵
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 8.141.95.1463⤵
- System Location Discovery: System Language Discovery
PID:3028
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 8.137.102.2502⤵
- System Location Discovery: System Language Discovery
PID:4404 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 8.137.102.2503⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2020
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 198.46.131.292⤵
- System Location Discovery: System Language Discovery
PID:3728 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 198.46.131.293⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2556
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 23.94.136.1932⤵PID:3532
-
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 23.94.136.1933⤵
- System Location Discovery: System Language Discovery
PID:2468
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 47.97.170.382⤵PID:2960
-
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 47.97.170.383⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4900
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 47.109.24.1612⤵PID:4688
-
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 47.109.24.1613⤵
- System Location Discovery: System Language Discovery
PID:2324
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 111.68.8.292⤵
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 111.68.8.293⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3144
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 199.15.77.1402⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 199.15.77.1403⤵
- System Location Discovery: System Language Discovery
PID:2840
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 45.248.10.2372⤵
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 45.248.10.2373⤵
- System Location Discovery: System Language Discovery
PID:1360
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 103.36.167.562⤵
- System Location Discovery: System Language Discovery
PID:4520 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 103.36.167.563⤵PID:1620
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 103.57.248.572⤵
- System Location Discovery: System Language Discovery
PID:4084 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 103.57.248.573⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2420
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 193.124.0.992⤵
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 193.124.0.993⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3492
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 36.134.129.182⤵
- System Location Discovery: System Language Discovery
PID:548 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 36.134.129.183⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4380
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 103.194.184.1222⤵
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 103.194.184.1223⤵PID:4364
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 47.121.190.1732⤵
- System Location Discovery: System Language Discovery
PID:3664 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 47.121.190.1733⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3988
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 111.68.8.292⤵PID:2240
-
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 111.68.8.293⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4496
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 199.15.77.1402⤵
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 199.15.77.1403⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2152
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 45.248.10.2372⤵PID:456
-
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 45.248.10.2373⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1416
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 103.36.167.562⤵
- System Location Discovery: System Language Discovery
PID:452 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 103.36.167.563⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4804
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 103.57.248.572⤵PID:1088
-
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 103.57.248.573⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2620
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 193.124.0.992⤵PID:716
-
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 193.124.0.993⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3124
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c netsh int ip delete addr 1 36.134.129.182⤵
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Windows\SysWOW64\netsh.exenetsh int ip delete addr 1 36.134.129.183⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3548
-
-