e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b

General

Target

e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
Size

992KB
MD5

245e85a3803b4a0bcd4a5b09759b8dd3
SHA1

6c8814a17c21f66c43be206368657cc179ee67a1
SHA256

e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b
SHA512

227e193dab3d01f0cffffeb4cb2a38ca8ea357245a5b92cb3b829beb5d8eb7376f14784014be73077ffe72603e4b0397ff9c906d475c2232eb2944965dabf1c1
SSDEEP

12288:lzAHg+1yahuV0voyd0gP8YtNmdDWtGnYoa3qkmO/UQ/7MVjzXmhQOE4Ro:FYghWuyvV0W3KWcnYoU3/P/gVjzWhjR

Score

10^/10

defense_evasion evasion

Malware Config

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
defense_evasion

Clear Windows Event Logs
T1070.001

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx svchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe

pid	process
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe

pid process

2124 e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe
Token: SeTakeOwnershipPrivilege	864	svchost.exe
Token: SeLoadDriverPrivilege	864	svchost.exe
Token: SeSystemtimePrivilege	864	svchost.exe
Token: SeBackupPrivilege	864	svchost.exe
Token: SeRestorePrivilege	864	svchost.exe
Token: SeShutdownPrivilege	864	svchost.exe
Token: SeSystemEnvironmentPrivilege	864	svchost.exe
Token: SeUndockPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	864	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe
Token: SeTakeOwnershipPrivilege	864	svchost.exe
Token: SeLoadDriverPrivilege	864	svchost.exe
Token: SeSystemtimePrivilege	864	svchost.exe
Token: SeBackupPrivilege	864	svchost.exe
Token: SeRestorePrivilege	864	svchost.exe
Token: SeShutdownPrivilege	864	svchost.exe
Token: SeSystemEnvironmentPrivilege	864	svchost.exe
Token: SeUndockPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	864	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe
Token: SeTakeOwnershipPrivilege	864	svchost.exe
Token: SeLoadDriverPrivilege	864	svchost.exe
Token: SeSystemtimePrivilege	864	svchost.exe
Token: SeBackupPrivilege	864	svchost.exe
Token: SeRestorePrivilege	864	svchost.exe
Token: SeShutdownPrivilege	864	svchost.exe
Token: SeSystemEnvironmentPrivilege	864	svchost.exe
Token: SeUndockPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	864	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe
Token: SeTakeOwnershipPrivilege	864	svchost.exe
Token: SeLoadDriverPrivilege	864	svchost.exe
Token: SeSystemtimePrivilege	864	svchost.exe
Token: SeBackupPrivilege	864	svchost.exe
Token: SeRestorePrivilege	864	svchost.exe
Token: SeShutdownPrivilege	864	svchost.exe
Token: SeSystemEnvironmentPrivilege	864	svchost.exe
Token: SeUndockPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	864	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe
Token: SeTakeOwnershipPrivilege	864	svchost.exe
Token: SeLoadDriverPrivilege	864	svchost.exe
Token: SeSystemtimePrivilege	864	svchost.exe
Token: SeBackupPrivilege	864	svchost.exe
Token: SeRestorePrivilege	864	svchost.exe
Token: SeShutdownPrivilege	864	svchost.exe
Token: SeSystemEnvironmentPrivilege	864	svchost.exe
Token: SeUndockPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	864	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

svchost.exe

pid process

752 svchost.exe

pid	process
752	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe

description	pid	process	target process
PID 2124 wrote to memory of 616	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 692	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 752	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 828	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 864	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 976	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 280	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1048	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1176	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 616	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 692	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 752	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 828	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 864	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 976	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 280	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1048	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1176	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 616	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 692	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 752	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 828	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 864	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 976	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 280	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1048	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1176	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 616	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 692	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 752	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 828	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 864	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 976	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 280	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1048	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1176	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 616	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 692	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 752	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 828	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 864	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 976	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 280	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1048	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1176	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 616	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 692	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 752	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 828	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 864	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 976	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 280	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1048	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1176	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 616	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 692	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 752	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 828	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 864	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 976	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 280	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1048	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 1176	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe
PID 2124 wrote to memory of 616	2124	e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe	svchost.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
- Modifies security service
- Indicator Removal: Clear Windows Event Logs
- Suspicious use of UnmapMainImage
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:864
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:1176

C:\Users\Admin\AppData\Local\Temp\e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe
"C:\Users\Admin\AppData\Local\Temp\e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Indicator Removal

1

T1070

Clear Windows Event Logs

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b.exe

Filesize
992KB

MD5
245e85a3803b4a0bcd4a5b09759b8dd3

SHA1
6c8814a17c21f66c43be206368657cc179ee67a1

SHA256
e026cb1d0c332e89db275cb72ddedad2ddd2463ff8ceb73bc1a403460570407b

SHA512
227e193dab3d01f0cffffeb4cb2a38ca8ea357245a5b92cb3b829beb5d8eb7376f14784014be73077ffe72603e4b0397ff9c906d475c2232eb2944965dabf1c1

Download Submit
memory/616-2-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/752-171-0x000007FF404C0000-0x000007FF40580000-memory.dmp

Filesize
768KB

Download
memory/752-1817-0x000007FF404C0000-0x000007FF40580000-memory.dmp

Filesize
768KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads