e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
Size 193KB
Sample260722-n7gyaaee52
SHA256 e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5
MD5 6852071b16eb08799927839aaff6f269
SHA1 491bbff6611718239807ba306517f7dc0e929246
SHA512 f30d296195e40be6ce5ed7031a1f26bdf755e66e15c2bd0ec289c3386d3ed7241e8826ba256945e91678defbbe064dc25847a50bfff78afe4b3d92142a9799c0
SSDEEP 3072:5TnPccm/DMSVMqRf/yxQ/DnZ3iIVv1uy8f8LRLb7JlptpIowZnfrSa98zToZW2bh:h0wYNn3DHgx9id1
TLSH
T11514D60BB7985F02C11C1672C1DF993043F26E931B73D7957E89B3ED0A097A79D4AA0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts2	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
File created	C:\Windows\System32\drivers\etc\hosts2	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Launches sc.exe 36 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5984	sc.exe
5128	sc.exe
3552	sc.exe
3792	sc.exe
6104	sc.exe
1088	sc.exe
4848	sc.exe
4300	sc.exe
2596	sc.exe
2808	sc.exe
2228	sc.exe
3320	sc.exe
5928	sc.exe
4400	sc.exe
1436	sc.exe
3820	sc.exe
5740	sc.exe
2664	sc.exe
3744	sc.exe
3452	sc.exe
6000	sc.exe
4736	sc.exe
4844	sc.exe
4652	sc.exe
4680	sc.exe
1936	sc.exe
2284	sc.exe
2908	sc.exe
4164	sc.exe
3500	sc.exe
5664	sc.exe
1436	sc.exe
5148	sc.exe
3360	sc.exe
5976	sc.exe
4576	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2664	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	91
PID 2784 wrote to memory of 4584	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	93
PID 4584 wrote to memory of 5612	4584	net.exe	95
PID 2784 wrote to memory of 4300	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	96
PID 2784 wrote to memory of 2816	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	98
PID 2816 wrote to memory of 476	2816	net.exe	100
PID 2784 wrote to memory of 1936	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	101
PID 2784 wrote to memory of 4200	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	103
PID 4200 wrote to memory of 5900	4200	net.exe	105
PID 2784 wrote to memory of 3552	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	106
PID 2784 wrote to memory of 4444	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	108
PID 4444 wrote to memory of 1780	4444	net.exe	110
PID 2784 wrote to memory of 5984	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	111
PID 2784 wrote to memory of 1788	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	113
PID 1788 wrote to memory of 1992	1788	net.exe	115
PID 2784 wrote to memory of 2656	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	116
PID 2656 wrote to memory of 3220	2656	net.exe	118
PID 2784 wrote to memory of 5976	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	119
PID 2784 wrote to memory of 4852	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	121
PID 4852 wrote to memory of 4192	4852	net.exe	123
PID 2784 wrote to memory of 1436	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	124
PID 2784 wrote to memory of 3732	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	126
PID 3732 wrote to memory of 760	3732	net.exe	128
PID 2784 wrote to memory of 4932	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	129
PID 4932 wrote to memory of 4136	4932	net.exe	131
PID 2784 wrote to memory of 3744	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	132
PID 2784 wrote to memory of 5188	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	134
PID 5188 wrote to memory of 1108	5188	net.exe	136
PID 2784 wrote to memory of 2284	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	137
PID 2784 wrote to memory of 576	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	139
PID 576 wrote to memory of 1536	576	net.exe	141
PID 2784 wrote to memory of 4892	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	142
PID 4892 wrote to memory of 4816	4892	net.exe	144
PID 2784 wrote to memory of 2596	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	145
PID 2784 wrote to memory of 4380	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	147
PID 4380 wrote to memory of 5364	4380	net.exe	149
PID 2784 wrote to memory of 2808	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	150
PID 2784 wrote to memory of 1220	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	152
PID 1220 wrote to memory of 3004	1220	net.exe	154
PID 2784 wrote to memory of 5132	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	155
PID 5132 wrote to memory of 1752	5132	net.exe	157
PID 2784 wrote to memory of 3820	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	158
PID 2784 wrote to memory of 5356	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	160
PID 5356 wrote to memory of 200	5356	net.exe	162
PID 2784 wrote to memory of 3792	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	163
PID 2784 wrote to memory of 2424	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	165
PID 2424 wrote to memory of 2604	2424	net.exe	167
PID 2784 wrote to memory of 5948	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	168
PID 5948 wrote to memory of 1424	5948	net.exe	170
PID 2784 wrote to memory of 3452	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	171
PID 2784 wrote to memory of 5436	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	173
PID 5436 wrote to memory of 3460	5436	net.exe	175
PID 2784 wrote to memory of 2228	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	176
PID 2784 wrote to memory of 3556	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	178
PID 3556 wrote to memory of 4672	3556	net.exe	180
PID 2784 wrote to memory of 4316	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	181
PID 4316 wrote to memory of 2820	4316	net.exe	183
PID 2784 wrote to memory of 4576	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	184
PID 2784 wrote to memory of 3560	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	186
PID 3560 wrote to memory of 1968	3560	net.exe	188
PID 2784 wrote to memory of 6000	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	189
PID 2784 wrote to memory of 5400	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	191
PID 5400 wrote to memory of 4372	5400	net.exe	193
PID 2784 wrote to memory of 3248	2784	e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe	194

C:\Users\Admin\AppData\Local\Temp\e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe
"C:\Users\Admin\AppData\Local\Temp\e24b80308ce3bd0b6441993c3389a28d368c432f19b3a019dd9bf23c37345da5.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:2664
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:5612
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4300
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:476
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:1936
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:5900
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:3552
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:1780
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:5984
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:1992
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:3220
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:5976
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:4192
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:1436
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:760
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:4136
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:3744
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:1108
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:2284
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:1536
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:4816
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:2596
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:5364
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:2808
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:3004
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:1752
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:3820
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:200
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:3792
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:2604
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:1424
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:3452
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:3460
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:2228
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:4672
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:2820
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4576
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:1968
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:6000
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:4372
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  PID:3248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:4504
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:5664
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:4624
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:4948
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:1436
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:5472
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:4364
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  PID:5396
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:5688
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:6104
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:5864
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:4368
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:2908
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:2296
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:5904
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  PID:3440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:5920
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4736
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:4320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:2596
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:1088
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:4108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:4840
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  PID:2452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:616
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:3320
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:4472
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4164
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:3476
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:2604
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  PID:2536
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:5012
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4844
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:5196
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:5440
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4652
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:5224
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:2844
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  PID:5644
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:1588
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:5928
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:2088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:5752
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:5148
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:4372
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:2940
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  PID:4972
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:4332
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4400
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:4612
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:1772
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4848
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:2392
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:4632
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  PID:2384
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:4460
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:5740
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:3536
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:1920
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:3500
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:2740
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:620
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  PID:1000
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:3124
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:5128
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:5256
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:5784
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:3360
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:1168
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:2284
- C:\Windows\SYSTEM32\net.exe
  net stop zmserv
  2⤵
  PID:4796
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zmserv
    3⤵
    PID:4304
- C:\Windows\SYSTEM32\sc.exe
  sc create zmserv binPath= C:\Users\Admin\AppData\Local\Temp\zmserv.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4680
- C:\Windows\SYSTEM32\net.exe
  net start zmserv
  2⤵
  PID:1292
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start zmserv
    3⤵
    PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-0-0x00007FFA37AEF000-0x00007FFA37AF0000-memory.dmp

Download

memory/2784-1-0x000001E2F7DF0000-0x000001E2F7E26000-memory.dmp

Download

memory/2784-2-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-3-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-4-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-5-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-6-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-7-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-8-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-9-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-10-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-11-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-12-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-13-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download