246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe
Size

5.6MB
MD5

9131ecd24f80c67f05d3a145e24251dd
SHA1

52bde2feddadd2c5dfdad19a5303e78dd7b660d8
SHA256

246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63
SHA512

a49b6b6303210b5cb9a5f0ffe39f38c83027562c165abf50b823d45de978eadbfa319cbec4425089ea30be8e49796665c52207d799cb56467f76facecdc9b753
SSDEEP

98304:tJRl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcM:tWOuK6mn9NzgMoYkSIvUcwti7TQlvciD

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2540	246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates processes with tasklist 1 TTPs 29 IoCs

discovery

Process Discovery

T1057

pid	Process
2676	tasklist.exe
1344	tasklist.exe
2084	tasklist.exe
1648	tasklist.exe
2688	tasklist.exe
2160	tasklist.exe
2360	tasklist.exe
2616	tasklist.exe
1428	tasklist.exe
2632	tasklist.exe
2656	tasklist.exe
1132	tasklist.exe
996	tasklist.exe
1864	tasklist.exe
1728	tasklist.exe
2832	tasklist.exe
1976	tasklist.exe
2960	tasklist.exe
2948	tasklist.exe
2540	tasklist.exe
1696	tasklist.exe
2040	tasklist.exe
2256	tasklist.exe
3048	tasklist.exe
2624	tasklist.exe
2156	tasklist.exe
2336	tasklist.exe
628	tasklist.exe
2772	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 28 IoCs

evasion

pid	Process
2496	timeout.exe
376	timeout.exe
1332	timeout.exe
572	timeout.exe
2700	timeout.exe
1232	timeout.exe
2008	timeout.exe
1360	timeout.exe
1040	timeout.exe
2900	timeout.exe
1000	timeout.exe
2368	timeout.exe
2824	timeout.exe
2296	timeout.exe
3064	timeout.exe
2744	timeout.exe
2244	timeout.exe
1520	timeout.exe
544	timeout.exe
3056	timeout.exe
2644	timeout.exe
2696	timeout.exe
1960	timeout.exe
2032	timeout.exe
2548	timeout.exe
796	timeout.exe
912	timeout.exe
1940	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2540	246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe
2540	246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe
2540	246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe
Token: SeDebugPrivilege	2772	tasklist.exe
Token: SeDebugPrivilege	2624	tasklist.exe
Token: SeDebugPrivilege	2616	tasklist.exe
Token: SeDebugPrivilege	1696	tasklist.exe
Token: SeDebugPrivilege	2632	tasklist.exe
Token: SeDebugPrivilege	2688	tasklist.exe
Token: SeDebugPrivilege	1976	tasklist.exe
Token: SeDebugPrivilege	2156	tasklist.exe
Token: SeDebugPrivilege	2040	tasklist.exe
Token: SeDebugPrivilege	1428	tasklist.exe
Token: SeDebugPrivilege	2960	tasklist.exe
Token: SeDebugPrivilege	2832	tasklist.exe
Token: SeDebugPrivilege	2656	tasklist.exe
Token: SeDebugPrivilege	2336	tasklist.exe
Token: SeDebugPrivilege	1132	tasklist.exe
Token: SeDebugPrivilege	996	tasklist.exe
Token: SeDebugPrivilege	1864	tasklist.exe
Token: SeDebugPrivilege	1728	tasklist.exe
Token: SeDebugPrivilege	628	tasklist.exe
Token: SeDebugPrivilege	1648	tasklist.exe
Token: SeDebugPrivilege	2256	tasklist.exe
Token: SeDebugPrivilege	2676	tasklist.exe
Token: SeDebugPrivilege	3048	tasklist.exe
Token: SeDebugPrivilege	1344	tasklist.exe
Token: SeDebugPrivilege	2160	tasklist.exe
Token: SeDebugPrivilege	2084	tasklist.exe
Token: SeDebugPrivilege	2948	tasklist.exe
Token: SeDebugPrivilege	2360	tasklist.exe
Token: SeDebugPrivilege	2540	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2768	2540	246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe	32
PID 2540 wrote to memory of 2768	2540	246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe	32
PID 2540 wrote to memory of 2768	2540	246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe	32
PID 2768 wrote to memory of 3020	2768	cmd.exe	34
PID 2768 wrote to memory of 3020	2768	cmd.exe	34
PID 2768 wrote to memory of 3020	2768	cmd.exe	34
PID 2768 wrote to memory of 2772	2768	cmd.exe	35
PID 2768 wrote to memory of 2772	2768	cmd.exe	35
PID 2768 wrote to memory of 2772	2768	cmd.exe	35
PID 2768 wrote to memory of 3008	2768	cmd.exe	36
PID 2768 wrote to memory of 3008	2768	cmd.exe	36
PID 2768 wrote to memory of 3008	2768	cmd.exe	36
PID 2768 wrote to memory of 2744	2768	cmd.exe	37
PID 2768 wrote to memory of 2744	2768	cmd.exe	37
PID 2768 wrote to memory of 2744	2768	cmd.exe	37
PID 2768 wrote to memory of 2624	2768	cmd.exe	38
PID 2768 wrote to memory of 2624	2768	cmd.exe	38
PID 2768 wrote to memory of 2624	2768	cmd.exe	38
PID 2768 wrote to memory of 2316	2768	cmd.exe	39
PID 2768 wrote to memory of 2316	2768	cmd.exe	39
PID 2768 wrote to memory of 2316	2768	cmd.exe	39
PID 2768 wrote to memory of 2644	2768	cmd.exe	40
PID 2768 wrote to memory of 2644	2768	cmd.exe	40
PID 2768 wrote to memory of 2644	2768	cmd.exe	40
PID 2768 wrote to memory of 2616	2768	cmd.exe	41
PID 2768 wrote to memory of 2616	2768	cmd.exe	41
PID 2768 wrote to memory of 2616	2768	cmd.exe	41
PID 2768 wrote to memory of 2612	2768	cmd.exe	42
PID 2768 wrote to memory of 2612	2768	cmd.exe	42
PID 2768 wrote to memory of 2612	2768	cmd.exe	42
PID 2768 wrote to memory of 2696	2768	cmd.exe	43
PID 2768 wrote to memory of 2696	2768	cmd.exe	43
PID 2768 wrote to memory of 2696	2768	cmd.exe	43
PID 2768 wrote to memory of 1696	2768	cmd.exe	44
PID 2768 wrote to memory of 1696	2768	cmd.exe	44
PID 2768 wrote to memory of 1696	2768	cmd.exe	44
PID 2768 wrote to memory of 320	2768	cmd.exe	45
PID 2768 wrote to memory of 320	2768	cmd.exe	45
PID 2768 wrote to memory of 320	2768	cmd.exe	45
PID 2768 wrote to memory of 2496	2768	cmd.exe	46
PID 2768 wrote to memory of 2496	2768	cmd.exe	46
PID 2768 wrote to memory of 2496	2768	cmd.exe	46
PID 2768 wrote to memory of 2632	2768	cmd.exe	47
PID 2768 wrote to memory of 2632	2768	cmd.exe	47
PID 2768 wrote to memory of 2632	2768	cmd.exe	47
PID 2768 wrote to memory of 2344	2768	cmd.exe	48
PID 2768 wrote to memory of 2344	2768	cmd.exe	48
PID 2768 wrote to memory of 2344	2768	cmd.exe	48
PID 2768 wrote to memory of 1232	2768	cmd.exe	49
PID 2768 wrote to memory of 1232	2768	cmd.exe	49
PID 2768 wrote to memory of 1232	2768	cmd.exe	49
PID 2768 wrote to memory of 2688	2768	cmd.exe	50
PID 2768 wrote to memory of 2688	2768	cmd.exe	50
PID 2768 wrote to memory of 2688	2768	cmd.exe	50
PID 2768 wrote to memory of 2812	2768	cmd.exe	51
PID 2768 wrote to memory of 2812	2768	cmd.exe	51
PID 2768 wrote to memory of 2812	2768	cmd.exe	51
PID 2768 wrote to memory of 1960	2768	cmd.exe	52
PID 2768 wrote to memory of 1960	2768	cmd.exe	52
PID 2768 wrote to memory of 1960	2768	cmd.exe	52
PID 2768 wrote to memory of 1976	2768	cmd.exe	53
PID 2768 wrote to memory of 1976	2768	cmd.exe	53
PID 2768 wrote to memory of 1976	2768	cmd.exe	53
PID 2768 wrote to memory of 1928	2768	cmd.exe	54

C:\Users\Admin\AppData\Local\Temp\246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe
"C:\Users\Admin\AppData\Local\Temp\246be4970b93f526c742ff8f7f9030b292294480f79df9a8f1bd9626df459e63.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpF1FD.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpF1FD.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3020
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3008
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2744
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2316
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2644
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2612
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2696
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:320
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2496
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2344
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1232
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2812
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1960
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1976
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1928
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:796
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1716
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2032
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2848
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2008
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1192
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:376
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2196
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2824
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1588
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2296
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2076
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2244
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2268
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1360
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:304
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3064
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1996
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1332
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1032
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:572
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1732
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:912
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:628
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:952
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1520
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1156
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1040
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:292
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:544
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2108
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2700
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1740
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1000
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1004
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3056
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3000
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1940
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1688
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2548
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2748
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2368
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1944
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2900
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2540"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF1FD.tmp.bat

Filesize
362B

MD5
e8cba6dcd2d043ebc6a047085276aa70

SHA1
e8b18585cec73c2a448287de8553b67a974576d0

SHA256
6d9ce77539f36c76d025fc7add0f94a4eaa40fe9dc23db71fa31daab8c590fd7

SHA512
8e7572b9faff988636146aeb2a4a0582946e10c4b6fc94290414d7956256b40190992b3c6e03a221d2cbd23b6fd678243222f52d990afd98f088b2534e5bddb6

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

Filesize
1.7MB

MD5
65ccd6ecb99899083d43f7c24eb8f869

SHA1
27037a9470cc5ed177c0b6688495f3a51996a023

SHA256
aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

SHA512
533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

Download Submit
memory/2540-0-0x000007FEF52D3000-0x000007FEF52D4000-memory.dmp

Filesize
4KB

Download
memory/2540-1-0x0000000001250000-0x00000000017F2000-memory.dmp

Filesize
5.6MB

Download
memory/2540-6-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2540-10-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download