Analysis
- max time kernel
20s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
14/05/2025, 05:15
General
- Target 31.exe
- Size 12.5MB
- Sample250514-fx2wpstry2
- SHA256 7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267
Malware Config
Extracted
-
formbook
-
4.0
-
w9z
-
crazzysex.com
-
hanferd.com
-
gteesrd.com
-
bayfrontbabyplace.com
-
jicuiquan.net
-
relationshiplink.net
-
ohchacyberphoto.com
-
kauegimenes.com
-
powerful-seldom.com
-
ketotoken.com
-
make-money-online-success.com
-
redgoldcollection.com
-
hannan-football.com
-
hamptondc.com
-
vllii.com
-
aa8520.com
-
platform35markethall.com
-
larozeimmo.com
-
oligopoly.net
-
llhak.info
Extracted
-
gozi
-
build
300869
-
exe_type
loader
Extracted
-
gozi
-
86920224
-
https://sibelikinciel.xyz
-
build
300869
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
Extracted
-
formbook
-
4.1
-
i0qi
-
mytakeawaybox.com
-
goutaihuo.com
-
kuzey.site
-
uppertenpiercings.amsterdam
-
honeygrandpa.com
-
jenniferabramslaw.com
-
ncarian.com
-
heavilymeditatedhouston.com
-
gsbjyzx.com
-
akisanblog.com
-
taoyuanreed.com
-
jasperrvservices.com
-
yabbanet.com
-
myhealthfuldiet.com
-
flipdigitalcoins.com
-
toes.photos
-
shoottillyoumiss.com
-
maserental.com
-
smarteacher.net
-
hamdimagdeco.com
Extracted
-
qakbot
-
324.141
-
spx129
-
1590734339
-
94.10.81.239:443
-
94.52.160.116:443
-
67.0.74.119:443
-
175.137.136.79:443
-
73.232.165.200:995
-
79.119.67.149:443
-
62.38.111.70:2222
-
108.58.9.238:993
-
216.110.249.252:2222
-
67.209.195.198:3389
-
84.247.55.190:443
-
96.37.137.42:443
-
94.176.220.76:2222
-
173.245.152.231:443
-
96.227.122.123:443
-
188.192.75.8:995
-
24.229.245.124:995
-
71.163.225.75:443
-
75.71.77.59:443
-
104.36.135.227:443
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Dharma family
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Gozi family
- Qakbot family
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- AgentTesla payload 6 IoCs
- CryptOne packer 2 IoCs
Detects CryptOne packer defined in NCC blogpost.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Formbook payload 3 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- ReZer0 packer 3 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Drops startup file 1 IoCs
- Executes dropped EXE 34 IoCs
- Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 4 IoCs
- Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 39 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies registry class 1 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 53 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\31.exe"C:\Users\Admin\AppData\Local\Temp\31.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8220.tmp\8221.tmp\8222.bat C:\Users\Admin\AppData\Local\Temp\31.exe"3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"4⤵
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\4.exeC:\Users\Admin\AppData\Roaming\4.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 2765⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\5.exeC:\Users\Admin\AppData\Roaming\5.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\6.exeC:\Users\Admin\AppData\Roaming\6.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\7.exeC:\Users\Admin\AppData\Roaming\7.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\8.exeC:\Users\Admin\AppData\Roaming\8.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\feeed.exe"C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"6⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile7⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\9.exeC:\Users\Admin\AppData\Roaming\9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEE0.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
-
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
-
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
-
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
-
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\10.exeC:\Users\Admin\AppData\Roaming\10.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 2485⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\11.exeC:\Users\Admin\AppData\Roaming\11.exe4⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2BA.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\11.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\12.exeC:\Users\Admin\AppData\Roaming\12.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\14.exeC:\Users\Admin\AppData\Roaming\14.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 2485⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\15.exeC:\Users\Admin\AppData\Roaming\15.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\15.exeC:\Users\Admin\AppData\Roaming\15.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\16.exeC:\Users\Admin\AppData\Roaming\16.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"5⤵
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\17.exeC:\Users\Admin\AppData\Roaming\17.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 2525⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\18.exeC:\Users\Admin\AppData\Roaming\18.exe4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\19.exeC:\Users\Admin\AppData\Roaming\19.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\19.exeC:\Users\Admin\AppData\Roaming\19.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\20.exeC:\Users\Admin\AppData\Roaming\20.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\20.exeC:\Users\Admin\AppData\Roaming\20.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\21.exeC:\Users\Admin\AppData\Roaming\21.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\21.exe"{path}"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\22.exeC:\Users\Admin\AppData\Roaming\22.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\23.exeC:\Users\Admin\AppData\Roaming\23.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\24.exeC:\Users\Admin\AppData\Roaming\24.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\24.exe"{path}"5⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\25.exeC:\Users\Admin\AppData\Roaming\25.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeC:\Users\Admin\AppData\Roaming\25.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\26.exeC:\Users\Admin\AppData\Roaming\26.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5E86.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe /C5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Uyiyaohiuoy\xaisik.exeC:\Users\Admin\AppData\Roaming\Microsoft\Uyiyaohiuoy\xaisik.exe5⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Uyiyaohiuoy\xaisik.exeC:\Users\Admin\AppData\Roaming\Microsoft\Uyiyaohiuoy\xaisik.exe /C6⤵
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
-
C:\Program Files (x86)\K4jbht\-zd0pjyyjrl-6hp.exe"C:\Program Files (x86)\K4jbht\-zd0pjyyjrl-6hp.exe"7⤵
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jhqnhblc /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I jhqnhblc" /SC ONCE /Z /ST 05:20 /ET 05:325⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\28.exeC:\Users\Admin\AppData\Roaming\28.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\28.exeC:\Users\Admin\AppData\Roaming\28.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\29.exeC:\Users\Admin\AppData\Roaming\29.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\30.exeC:\Users\Admin\AppData\Roaming\30.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"5⤵
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\31.exeC:\Users\Admin\AppData\Roaming\31.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\2.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\16.exe2⤵
-
C:\Windows\System32\16.exeC:\Windows\System32\16.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\18.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\pcalua.exe -a C:\Users\Admin\AppData\Roaming\feeed.exe2⤵
-
C:\Windows\system32\pcalua.exeC:\Windows\system32\pcalua.exe -a C:\Users\Admin\AppData\Roaming\feeed.exe3⤵
-
C:\Users\Admin\AppData\Roaming\feeed.exe"C:\Users\Admin\AppData\Roaming\feeed.exe"4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Dibromob\PRECONCE.vbs2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.vbs2⤵
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\11.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mshta.exe "C:\Windows\System32\Info.hta"2⤵
-
C:\Windows\system32\mshta.exemshta.exe "C:\Windows\System32\Info.hta"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mshta.exe "C:\Users\Admin\AppData\Roaming\Info.hta"2⤵
-
C:\Windows\system32\mshta.exemshta.exe "C:\Users\Admin\AppData\Roaming\Info.hta"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\CpSnJ\CpSnJ.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\CpSnJ\CpSnJ.exeC:\Users\Admin\AppData\Local\Temp\CpSnJ\CpSnJ.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Program Files (x86)\K4jbht\-zd0pjyyjrl-6hp.exe2⤵
-
-
C:\Program Files (x86)\K4jbht\-zd0pjyyjrl-6hp.exe"C:\Program Files (x86)\K4jbht\-zd0pjyyjrl-6hp.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 956 -ip 9561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4436 -ip 44361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5008 -ip 50081⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2776 -ip 27761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2052 -ip 20521⤵
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:11956 CREDAT:17410 /prefetch:22⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
AppvIsvSubsystems32.dll.id-62220C3F.[[email protected]].BOMBO
search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
8222.bat
Kno483A.tmp
1.jar
10.exe
11.exe
12.exe
13.exe
14.exe
15.exe
17.exe
18.exe
19.exe
2.exe
20.exe
21.exe
22.exe
23.exe
24.exe
25.exe
26.exe
27.exe
28.exe
29.exe
3.exe
30.exe
31.exe
4.exe
5.exe
6.exe
7.exe
8.exe
9.exe
16.exe
index.html
license
license
.travis.yml
GOVERNANCE.md
LICENSE
README.md
2015-01-30.md
duplex-browser.js
duplex.js
_stream_duplex.js
_stream_passthrough.js
_stream_readable.js
_stream_transform.js
_stream_writable.js
BufferList.js
destroy.js
stream-browser.js
stream.js
passthrough.js
readable-browser.js
readable.js
transform.js
writable-browser.js
writable.js
.travis.yml
LICENSE
README.md
string_decoder.js
LICENSE
.npmignore
Makefile
LICENSE
PULL_REQUEST_TEMPLATE
.travis.yml
appveyor.yml
LICENSE.md
LICENSE
LICENSE
LICENSE
LICENSE
README.md
LICENSE
.editorconfig
LICENSE
LICENSE
index.js
LICENSE
LICENSE
LICENSE
.travis.yml
LICENSE
LICENSE
.editorconfig
README.md
index.js
README.md
index.coffee
index.js
LICENSE
LICENSE
.npmignore
.npmignore
tag.js
.travis.yml
LICENSE.APACHE2
LICENSE.MIT
LICENSE
index.d.ts
LICENSE.txt
LICENSE
LICENSE
index.js
readme.md
node-gyp
node-gyp.cmd
npm
npm.cmd
npx
npx.cmd
network-icon-f659855f70bb0e12addd96250807c241.svg
is-windows.js
History.md
README.md
index.js
LICENSE
LICENSE
defer.js
en.js
LICENSE
index.js
readme.md
index.js
readme.md
License
LICENSE
license
LICENSE
README.md
license.md
LICENSE
.travis.yml
.npmignore
.travis.yml
es6.js
isPrimitive.js
es6-promise.auto.js
es6-promise.auto.map
es6-promise.map
stdio.js
buffer-stream.js
index.js
readme.md
LICENSE
LICENSE
.travis.yml
LICENSE
LICENSE.md
LICENSE
LICENSE
.npmignore
LICENSE
.jscs.json
.travis.yml
.jscs.json
component.json
nb.json
.travis.yml
parse.js
readme.markdown
prettify.css
prettify.js
sort-arrow-sprite.png
README.md
index.js
License
equation.gif
dns.js
stop.js
index.js
license
LICENSE
LICENSE
memory/1056-1559-0x00000000001C0000-0x0000000000258000-memory.dmp
memory/1056-8770-0x0000000006A40000-0x0000000006A96000-memory.dmp
memory/1056-5174-0x0000000007100000-0x0000000007162000-memory.dmp
memory/1596-85-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1992-1560-0x0000000000880000-0x00000000008EA000-memory.dmp
memory/1992-5338-0x0000000008040000-0x0000000008098000-memory.dmp
memory/2480-4753-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3044-1118-0x0000000002C90000-0x0000000002CE2000-memory.dmp
memory/3044-1120-0x0000000005450000-0x0000000005490000-memory.dmp
memory/3044-490-0x0000000000A60000-0x0000000000ACE000-memory.dmp
memory/3044-3645-0x0000000005610000-0x000000000563D000-memory.dmp
memory/3256-180-0x0000000002FB0000-0x0000000002FB1000-memory.dmp
memory/3256-4440-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
memory/3276-5040-0x0000000000820000-0x0000000000848000-memory.dmp
memory/3276-5179-0x0000000000820000-0x0000000000848000-memory.dmp
memory/3276-5177-0x0000000000820000-0x0000000000848000-memory.dmp
memory/3604-127-0x00000000009D0000-0x0000000000A8E000-memory.dmp
memory/3604-137-0x0000000005410000-0x000000000541A000-memory.dmp
memory/3604-488-0x0000000007DA0000-0x0000000007DF8000-memory.dmp
memory/3604-489-0x0000000007EB0000-0x0000000007F4C000-memory.dmp
memory/3604-199-0x0000000005690000-0x0000000005698000-memory.dmp
memory/3708-133-0x00000000051E0000-0x00000000051E8000-memory.dmp
memory/3708-118-0x0000000004D80000-0x0000000004E12000-memory.dmp
memory/3708-132-0x00000000059F0000-0x0000000005A34000-memory.dmp
memory/3708-114-0x0000000000C70000-0x0000000000C84000-memory.dmp
memory/3708-113-0x0000000000250000-0x00000000002FC000-memory.dmp
memory/3708-117-0x0000000000CD0000-0x0000000000CD8000-memory.dmp
memory/3708-131-0x0000000004EB0000-0x0000000004EB8000-memory.dmp
memory/3708-116-0x0000000005240000-0x00000000057E6000-memory.dmp
memory/3944-5029-0x000002BE52970000-0x000002BE52971000-memory.dmp
memory/3944-5237-0x000002BE52970000-0x000002BE52971000-memory.dmp
memory/3944-112-0x000002BE52970000-0x000002BE52971000-memory.dmp
memory/3944-134-0x000002BE52970000-0x000002BE52971000-memory.dmp
memory/4828-3647-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4828-90-0x0000000000690000-0x00000000006A0000-memory.dmp
memory/4948-487-0x0000000000820000-0x0000000000848000-memory.dmp
memory/4948-480-0x0000000000820000-0x0000000000848000-memory.dmp
memory/4948-485-0x0000000000820000-0x0000000000848000-memory.dmp
memory/4972-200-0x0000000000400000-0x000000000042D000-memory.dmp
memory/4972-82-0x0000000000400000-0x000000000042D000-memory.dmp
memory/4992-1113-0x0000000000860000-0x00000000009E4000-memory.dmp
memory/4992-4800-0x0000000005180000-0x0000000005186000-memory.dmp
memory/4992-1213-0x00000000013D0000-0x00000000013D6000-memory.dmp
memory/4992-4439-0x00000000055F0000-0x000000000578A000-memory.dmp
memory/4992-5051-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/5240-5027-0x0000000000400000-0x000000000044E000-memory.dmp
memory/5576-43149-0x00000000009C0000-0x0000000000A00000-memory.dmp
memory/5576-43151-0x0000000005300000-0x000000000545A000-memory.dmp
memory/5576-43150-0x0000000005150000-0x000000000516A000-memory.dmp
memory/8040-19441-0x0000000001950000-0x0000000001964000-memory.dmp
memory/8616-26771-0x0000000000400000-0x0000000000450000-memory.dmp
memory/9016-8529-0x0000000000400000-0x0000000000452000-memory.dmp
memory/9016-12397-0x0000000005440000-0x0000000005458000-memory.dmp
memory/9692-23003-0x0000000000400000-0x0000000000452000-memory.dmp
memory/9936-35023-0x0000000000400000-0x0000000000452000-memory.dmp
memory/11912-35949-0x0000000000400000-0x0000000000452000-memory.dmp
memory/12276-26547-0x0000000006EE0000-0x0000000006F02000-memory.dmp
memory/12276-18100-0x0000000003300000-0x0000000003314000-memory.dmp