Malware Analysis Report

2025-01-18 16:32

Sample ID 241201-224rra1pfm
Target e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe
SHA256 e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebb
Tags
netwire botnet discovery evasion persistence rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebb

Threat Level: Known bad

The file e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe was found to be: Known bad.

Malicious Activity Summary

netwire botnet discovery evasion persistence rat stealer

Netwire

NetWire RAT payload

Netwire family

Sets file to hidden

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

System Network Configuration Discovery: Internet Connection Discovery

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-01 23:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-01 23:05

Reported

2024-12-01 23:07

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 276 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\attrib.exe
PID 276 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\attrib.exe
PID 276 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\attrib.exe
PID 276 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\attrib.exe
PID 276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\REG.exe
PID 276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\REG.exe
PID 276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\REG.exe
PID 276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\REG.exe
PID 276 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 276 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe

"C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe"

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe

"C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe"

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 wallou.publicvm.com udp
SG 139.99.66.103:3365 wallou.publicvm.com tcp
US 8.8.8.8:53 mediafire.duckdns.org udp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp

Files

memory/276-0-0x0000000074C01000-0x0000000074C02000-memory.dmp

memory/276-1-0x0000000074C00000-0x00000000751AB000-memory.dmp

memory/276-2-0x0000000074C00000-0x00000000751AB000-memory.dmp

memory/276-3-0x0000000074C00000-0x00000000751AB000-memory.dmp

\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe

MD5 e569a1b41541d2e7a1bd0ac55d1826a0
SHA1 f7657cc8993c94ffc86174f0343f530040058d8b
SHA256 e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebb
SHA512 0cf26d15a30fcb320da15f12ee925bdd04f53a3ae3ce3db19fb458c32a7e42417787d28763fe83dbc4e025fa8afd1fbef9e81bd64699d50b1a1e29c29123d218

memory/1464-6-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1464-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1464-18-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1464-15-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1464-13-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1464-10-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1464-8-0x0000000000400000-0x000000000041E000-memory.dmp

C:\ProgramData\IntelCore\IntelCore.exe

MD5 f662a0786bc0a61edd94691250a124d7
SHA1 6aa5f417d333f9e20c8219fc58fe7941470c0095
SHA256 39eb257581fff3298b935d0511a13675d5095019b8e7a5d4ecd3a2c85a742325
SHA512 71424f11415528e3c7797404d45157796c0cc44608fd6d6200ebfd86408092793fd9fcf48a8dedf9112aa408c084c73cc8ac0108d139b94165229d81b95d5cc6

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-01 23:05

Reported

2024-12-01 23:07

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe" C:\Windows\SysWOW64\REG.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ping.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1316 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\attrib.exe
PID 1316 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\attrib.exe
PID 1316 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\attrib.exe
PID 1316 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\REG.exe
PID 1316 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\REG.exe
PID 1316 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\REG.exe
PID 1316 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe
PID 1316 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe C:\Windows\SysWOW64\ping.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe

"C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe"

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Windows\SysWOW64\ping.exe

C:\Windows\System32\ping.exe google.com

C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe

"C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe"

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 wallou.publicvm.com udp
SG 139.99.66.103:3365 wallou.publicvm.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 mediafire.duckdns.org udp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 8.8.8.8:53 25.69.169.192.in-addr.arpa udp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp
US 192.169.69.25:3365 mediafire.duckdns.org tcp

Files

memory/1316-0-0x00000000747C2000-0x00000000747C3000-memory.dmp

memory/1316-1-0x00000000747C0000-0x0000000074D71000-memory.dmp

memory/1316-2-0x00000000747C0000-0x0000000074D71000-memory.dmp

memory/1316-3-0x00000000747C2000-0x00000000747C3000-memory.dmp

memory/1316-4-0x00000000747C0000-0x0000000074D71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe

MD5 e569a1b41541d2e7a1bd0ac55d1826a0
SHA1 f7657cc8993c94ffc86174f0343f530040058d8b
SHA256 e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebb
SHA512 0cf26d15a30fcb320da15f12ee925bdd04f53a3ae3ce3db19fb458c32a7e42417787d28763fe83dbc4e025fa8afd1fbef9e81bd64699d50b1a1e29c29123d218

memory/4024-6-0x0000000000400000-0x000000000041E000-memory.dmp

C:\ProgramData\IntelCore\IntelCore.exe

MD5 dc03782d152a7ba4fba996c8bb4edaba
SHA1 dc373fdb519d6f17b927caed0dcdd5322465b7b3
SHA256 dec5d405b552447c1c93e5cd282bd1850f50e6952a671cdda16ee4bde2c07185
SHA512 02989ac0777f076a2e12d62ebb1c15fc51efcadda69dd27fb0138bd6a1c6d33e181a65e3ef0cc3c232d02f8b7bbb0cd5e93ce72fd8dc073b6fa59787521baf3f

memory/4024-12-0x0000000000400000-0x000000000041E000-memory.dmp