phorphiex | 79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046

General

Target

79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
Size

1.5MB
MD5

d61e81f0e8eab297210d6ac0b971b1a2
SHA1

0da339927bd348696a743915bc7b6499d32fc97f
SHA256

79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046
SHA512

d41007c500ec99b4dbadd319bebe7aa4bbe9e5e226cbd0f27632abdb8dd2954aefccb811c9579094b2a8c08fdec3973a0dcf8d64994c6a9338b381bdea3e6af6
SSDEEP

24576:XfWzK0OUHSihN6Qr2/1A/g4jzkQlC+eEN7tbalAK6w6hC4O8b8ITDnloH2:OzK0OUymN29A/gu7eEJtbqAK6w6hC4O+

Score

10^/10

phorphiex discovery evasion execution loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LTK4xdKPAgFHPLan8kriAD7eY4heyy73mB

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4BB7ckkaPTyADc8trtuwDoZxywaR4eNL5cDJ3KBjq9GraN4mUFztf7mLS7WgT7Bh7uPqpjvA4ypVwXKCJ1vvLWWAFvSmDoD

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd

Attributes

mutex
mmn7nnm8na
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

sysppvrdnvs.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" sysppvrdnvs.exe
Phorphiex family
phorphiex

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysppvrdnvs.exe

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1357631044.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4324 powershell.exe
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
4324	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sysppvrdnvs.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sysppvrdnvs.exe

Executes dropped EXE 3 IoCs

Processes:

94AE.exe1357631044.exesysppvrdnvs.exe

pid process

2136 94AE.exe
4420 1357631044.exe
3820 sysppvrdnvs.exe

pid	process
2136	94AE.exe
4420	1357631044.exe
3820	sysppvrdnvs.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1357631044.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	1357631044.exe

Drops file in Windows directory 2 IoCs

Processes:

1357631044.exe

description ioc process

File created C:\Windows\sysppvrdnvs.exe 1357631044.exe
File opened for modification C:\Windows\sysppvrdnvs.exe 1357631044.exe
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

2040 sc.exe
4952 sc.exe
1968 sc.exe
1144 sc.exe
1380 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4872 1776 WerFault.exe 79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

description	ioc	process
File created	C:\Windows\sysppvrdnvs.exe	1357631044.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	1357631044.exe

pid	process
2040	sc.exe
4952	sc.exe
1968	sc.exe
1144	sc.exe
1380	sc.exe

pid	pid_target	process	target process
4872	1776	WerFault.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.exesc.exesc.exe79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe1357631044.exesysppvrdnvs.exesc.exepowershell.exesc.exesc.exe79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe94AE.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1357631044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94AE.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

description ioc process

Key created \REGISTRY\USER\ 79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

description	ioc	process
Key created	\REGISTRY\USER\	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

Modifies registry class 1 IoCs

Processes:

79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4324 powershell.exe
4324 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4324 powershell.exe

pid	process
4324	powershell.exe
4324	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4324	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
"C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\94AE.exe
  "C:\Users\Admin\AppData\Local\Temp\94AE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\1357631044.exe
    C:\Users\Admin\AppData\Local\Temp\1357631044.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4420
  - - C:\Windows\sysppvrdnvs.exe
      C:\Windows\sysppvrdnvs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Checks computer location settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      PID:3820
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4324
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2040
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4952
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1968
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1144
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1380
- C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
  "C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe" --channel=1728.0.905077801 --type=renderer
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 792
    3⤵
    - Program crash
    PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1776 -ip 1776
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1357631044.exe

Filesize
83KB

MD5
06560b5e92d704395bc6dae58bc7e794

SHA1
fbd3e4ae28620197d1f02bfc24adaf4ddacd2372

SHA256
9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d

SHA512
b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\94AE.exe

Filesize
9KB

MD5
8d8e6c7952a9dc7c0c73911c4dbc5518

SHA1
9098da03b33b2c822065b49d5220359c275d5e94

SHA256
feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

SHA512
91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gsqmd0lg.ofk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4324-45-0x000000006F790000-0x000000006F7DC000-memory.dmp

Filesize
304KB

Download
memory/4324-56-0x0000000007890000-0x0000000007933000-memory.dmp

Filesize
652KB

Download
memory/4324-30-0x0000000005FB0000-0x0000000006016000-memory.dmp

Filesize
408KB

Download
memory/4324-31-0x0000000006020000-0x0000000006086000-memory.dmp

Filesize
408KB

Download
memory/4324-28-0x0000000005750000-0x0000000005D78000-memory.dmp

Filesize
6.2MB

Download
memory/4324-41-0x0000000006090000-0x00000000063E4000-memory.dmp

Filesize
3.3MB

Download
memory/4324-42-0x0000000006670000-0x000000000668E000-memory.dmp

Filesize
120KB

Download
memory/4324-43-0x00000000066A0000-0x00000000066EC000-memory.dmp

Filesize
304KB

Download
memory/4324-44-0x0000000007840000-0x0000000007872000-memory.dmp

Filesize
200KB

Download
memory/4324-27-0x00000000050E0000-0x0000000005116000-memory.dmp

Filesize
216KB

Download
memory/4324-55-0x0000000006C70000-0x0000000006C8E000-memory.dmp

Filesize
120KB

Download
memory/4324-29-0x0000000005720000-0x0000000005742000-memory.dmp

Filesize
136KB

Download
memory/4324-57-0x0000000008070000-0x00000000086EA000-memory.dmp

Filesize
6.5MB

Download
memory/4324-58-0x00000000079C0000-0x00000000079DA000-memory.dmp

Filesize
104KB

Download
memory/4324-59-0x0000000007A40000-0x0000000007A4A000-memory.dmp

Filesize
40KB

Download
memory/4324-60-0x0000000007C40000-0x0000000007CD6000-memory.dmp

Filesize
600KB

Download
memory/4324-61-0x0000000007BD0000-0x0000000007BE1000-memory.dmp

Filesize
68KB

Download
memory/4324-62-0x0000000007C00000-0x0000000007C0E000-memory.dmp

Filesize
56KB

Download
memory/4324-63-0x0000000007C10000-0x0000000007C24000-memory.dmp

Filesize
80KB

Download
memory/4324-64-0x0000000007D00000-0x0000000007D1A000-memory.dmp

Filesize
104KB

Download
memory/4324-65-0x0000000007CE0000-0x0000000007CE8000-memory.dmp

Filesize
32KB

Download

description	pid	process	target process
PID 1728 wrote to memory of 2136	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	94AE.exe
PID 1728 wrote to memory of 2136	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	94AE.exe
PID 1728 wrote to memory of 2136	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	94AE.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
PID 1728 wrote to memory of 1776	1728	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe	79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads