Overview

overview

10

Static

static

3

6672b26a03...e5.exe

windows7-x64

10

6672b26a03...e5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 19:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe

  • Size

    499KB

  • MD5

    73aac8ac5dc4ded42398f9fe2a191c19

  • SHA1

    4f3ed7fa592f4ae4c4462928543dcbd4997f2549

  • SHA256

    6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5

  • SHA512

    cc5459746e50fe49d87f5facbb7ee79c1554697e54df2a615ace177ef0f439d134f188e19f51a1f866486237d3a79fa381d362b7da942dc74e00f675bc3cb58d

  • SSDEEP

    12288:0osBGYb7Hku+M1e02kE15gLXOCYeHcUiK9DRB1R5//+P25wENJYWfaBFyutY4ld2:cBGO7HkwGkE15AXOCYeHcU7

Score
10/10
formbookxloaderv4qpdiscoveryloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

v4qp

Decoy

je1XQKU1LfJPVLk=

nvf41a7FsTLs6uB/g+CR

U7mryF6DctZn6GEjr9Bm4g==

1SONGrPdh7wGEOXp3g==

2xX859r7qOFq7GYkr9Bm4g==

IYtzVUx0Oo0HmZawLQAARDvBf4dL

NH3iuBPNSzZTvpw/4KaG

rDehfiqIPbdMBS8G1g==

xhb2uJ0eBwo7k3djqxh60xoNt4VoeQ==

AFtKux3JgPGRkx3xUsciR6piSg==

m+3VoJadWcBvOAPpzKUNPoAxyplS

1DWKULdka3mxIKhEqGxQr7gxyplS

DGlFGBqWi5CtrCX9alyTuPzq

muvVM4slyTfxORwAZisVksCM78aSEVo=

D3biNgUbyg9E5pl+

/+1QLPssvl/Xxg==

I4lzTjaAcc1iBS8G1g==

wSwc4MmbShojhlZCrniTuPzq

jN5YO6ZXSfJPVLk=

4TUS4+ANuqHCRTM9sniTuPzq

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook family
    formbook
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader family
    xloader
  • Xloader payload 1 IoCs
    rat
  • Checks computer location settings 2 TTPs 23 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
    "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4996
    • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4360
    • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
      "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3732
      • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
        "{path}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1200
      • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
        "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
          "{path}"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3468
        • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
          "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1112
          • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
            "{path}"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3172
          • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
            "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:736
            • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
              "{path}"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1108
            • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
              "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
              6⤵
              • Checks computer location settings
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1140
              • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                "{path}"
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1096
              • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                7⤵
                • Checks computer location settings
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3880
                • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                  "{path}"
                  8⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4708
                • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                  "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                  8⤵
                  • Checks computer location settings
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3244
                  • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                    "{path}"
                    9⤵
                      PID:3288
                    • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                      "{path}"
                      9⤵
                        PID:3196
                      • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                        "{path}"
                        9⤵
                          PID:888
                        • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                          "{path}"
                          9⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1348
                        • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                          "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                          9⤵
                          • Checks computer location settings
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5056
                          • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                            "{path}"
                            10⤵
                              PID:4252
                            • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                              "{path}"
                              10⤵
                                PID:3024
                              • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                "{path}"
                                10⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1744
                              • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                10⤵
                                • Checks computer location settings
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2708
                                • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                  "{path}"
                                  11⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4480
                                • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                  "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                  11⤵
                                  • Checks computer location settings
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3936
                                  • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                    "{path}"
                                    12⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2856
                                  • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                    "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                    12⤵
                                    • Checks computer location settings
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4336
                                    • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                      "{path}"
                                      13⤵
                                        PID:2044
                                      • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                        "{path}"
                                        13⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1040
                                      • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                        "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                        13⤵
                                        • Checks computer location settings
                                        • System Location Discovery: System Language Discovery
                                        PID:4744
                                        • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                          "{path}"
                                          14⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2444
                                        • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                          "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                          14⤵
                                          • Checks computer location settings
                                          • Suspicious use of SetThreadContext
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1372
                                          • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                            "{path}"
                                            15⤵
                                              PID:3628
                                            • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                              "{path}"
                                              15⤵
                                                PID:4132
                                              • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                                15⤵
                                                • Checks computer location settings
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2716
                                                • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                  "{path}"
                                                  16⤵
                                                    PID:3812
                                                  • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                    "{path}"
                                                    16⤵
                                                      PID:2564
                                                    • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                                      16⤵
                                                      • Checks computer location settings
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3500
                                                      • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                        "{path}"
                                                        17⤵
                                                          PID:3636
                                                        • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                                          17⤵
                                                          • Checks computer location settings
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3928
                                                          • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                            "{path}"
                                                            18⤵
                                                              PID:1836
                                                            • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                              "{path}"
                                                              18⤵
                                                                PID:1984
                                                              • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                                                18⤵
                                                                • Checks computer location settings
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4108
                                                                • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                  "{path}"
                                                                  19⤵
                                                                    PID:1036
                                                                  • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                                                    19⤵
                                                                    • Checks computer location settings
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2804
                                                                    • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                      "{path}"
                                                                      20⤵
                                                                        PID:1120
                                                                      • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                                                        20⤵
                                                                        • Checks computer location settings
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2328
                                                                        • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                          "{path}"
                                                                          21⤵
                                                                            PID:5084
                                                                          • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                                                            21⤵
                                                                            • Checks computer location settings
                                                                            • Suspicious use of SetThreadContext
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2304
                                                                            • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                              "{path}"
                                                                              22⤵
                                                                                PID:3972
                                                                              • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                                                                22⤵
                                                                                • Checks computer location settings
                                                                                • Suspicious use of SetThreadContext
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:5000
                                                                                • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                  "{path}"
                                                                                  23⤵
                                                                                    PID:1160
                                                                                  • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                    "{path}"
                                                                                    23⤵
                                                                                      PID:4156
                                                                                    • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                                                                      23⤵
                                                                                      • Checks computer location settings
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3844
                                                                                      • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                        "{path}"
                                                                                        24⤵
                                                                                          PID:4732
                                                                                        • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe"
                                                                                          24⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3652
                                                                                          • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                            "{path}"
                                                                                            25⤵
                                                                                              PID:3192
                                                                                            • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                              "{path}"
                                                                                              25⤵
                                                                                                PID:1044
                                                                                              • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                                "{path}"
                                                                                                25⤵
                                                                                                  PID:5040
                                                                                                • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                                  "{path}"
                                                                                                  25⤵
                                                                                                    PID:4708
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe
                                                                                                    "{path}"
                                                                                                    25⤵
                                                                                                      PID:4668

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5.exe.log
                                                      Filesize

                                                      224B

                                                      MD5

                                                      9c4b66f77f12558c48b620ddfb44029d

                                                      SHA1

                                                      446651db643b943ec37b9b3599655e211a4bc73e

                                                      SHA256

                                                      42f723d18283fda6a0904046cc29ee8d10e562d20c7615259a46ae9c0e4c9708

                                                      SHA512

                                                      983aed0ec15a79b716ac6dc080146e4ed098c117c31167053fb5971649dc621d1db5292fdd76f3010f094b75d57ea0bdb35bc829c6ba37e4d276b266361dee8e

                                                      Download Submit

                                                    • memory/8-18-0x0000000074E30000-0x00000000753E1000-memory.dmp

                                                      Filesize

                                                      5.7MB

                                                      Download

                                                    • memory/8-16-0x0000000074E30000-0x00000000753E1000-memory.dmp

                                                      Filesize

                                                      5.7MB

                                                      Download

                                                    • memory/8-15-0x0000000074E30000-0x00000000753E1000-memory.dmp

                                                      Filesize

                                                      5.7MB

                                                      Download

                                                    • memory/8-14-0x0000000074E32000-0x0000000074E33000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/1200-12-0x0000000001510000-0x000000000185A000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                      Download

                                                    • memory/1200-21-0x0000000001510000-0x000000000185A000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                      Download

                                                    • memory/3732-9-0x0000000074E32000-0x0000000074E34000-memory.dmp

                                                      Filesize

                                                      8KB

                                                      Download

                                                    • memory/3732-8-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/3732-10-0x0000000074E30000-0x00000000753E1000-memory.dmp

                                                      Filesize

                                                      5.7MB

                                                      Download

                                                    • memory/3732-13-0x0000000074E30000-0x00000000753E1000-memory.dmp

                                                      Filesize

                                                      5.7MB

                                                      Download

                                                    • memory/4360-4-0x0000000001870000-0x0000000001BBA000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                      Download

                                                    • memory/4360-3-0x0000000000400000-0x000000000042C000-memory.dmp

                                                      Filesize

                                                      176KB

                                                      Download

                                                    • memory/4744-29-0x00000000754E0000-0x00000000754E8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/4996-0-0x0000000074E32000-0x0000000074E33000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/4996-7-0x0000000074E30000-0x00000000753E1000-memory.dmp

                                                      Filesize

                                                      5.7MB

                                                      Download

                                                    • memory/4996-2-0x0000000074E30000-0x00000000753E1000-memory.dmp

                                                      Filesize

                                                      5.7MB

                                                      Download

                                                    • memory/4996-1-0x0000000074E30000-0x00000000753E1000-memory.dmp

                                                      Filesize

                                                      5.7MB

                                                      Download