Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 08:53
General
- Target 0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe
- Size 1.6MB
- Sample261002-ktf72styet
- SHA256 0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 39 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 43 IoCs
- Executes a command shell one-liner 1 TTPs 37 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11F.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49A.bat4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2282.bat6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FC1.bat8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37FE.bat10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44CF.bat12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4760.bat14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A4E.bat16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C70.bat18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EB3.bat20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5049.bat22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a526C.bat24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a550C.bat26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a573E.bat28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5867.bat30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59BF.bat32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AC8.bat34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C10.bat36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D2A.bat38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E24.bat40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F0E.bat42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6018.bat44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a618F.bat46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6298.bat48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6392.bat50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64AC.bat52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65A6.bat54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66DE.bat56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67F7.bat58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6911.bat60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A1A.bat62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B43.bat64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C2D.bat66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D27.bat68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"69⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DE3.bat70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"71⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E9E.bat72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"73⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F5A.bat74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"C:\Users\Admin\AppData\Local\Temp\0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe"75⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"11⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"12⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 10203⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5860 -ip 58601⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
$$a11F.bat
$$a2282.bat
$$a2FC1.bat
$$a37FE.bat
$$a44CF.bat
$$a4760.bat
$$a49A.bat
$$a4A4E.bat
$$a4C70.bat
$$a4EB3.bat
$$a5049.bat
$$a526C.bat
$$a550C.bat
$$a573E.bat
$$a5867.bat
$$a59BF.bat
$$a5AC8.bat
$$a5C10.bat
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
0cb3dbd36bc60e45ced73cae9011bb302bb671fb2307d7744f26faa2ada07d50.exe.exe
Dll.dll
Logo1_.exe
_desktop.ini
memory/108-3790-0x0000000000400000-0x0000000000445000-memory.dmp
memory/916-3619-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1236-3796-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1580-3692-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1680-3637-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1704-3665-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1856-3802-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1880-3647-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2168-3823-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2168-3725-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2168-3642-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2532-3766-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2560-3748-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2644-3808-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2800-3821-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2800-3816-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3212-3736-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3436-0-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3436-13-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3780-3711-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3936-3601-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3952-3784-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4136-3814-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4144-3717-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4180-3730-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4228-3701-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4232-3628-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4408-3610-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4448-3742-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4504-3772-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4508-3656-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4820-24-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4924-3559-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4928-3576-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4928-3565-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4952-3592-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5348-3754-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5424-3778-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5524-3723-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5700-3683-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5860-2547-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5860-3561-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5860-11-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5860-2258-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5880-1802-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5960-3674-0x0000000000400000-0x0000000000445000-memory.dmp
memory/6096-3760-0x0000000000400000-0x0000000000445000-memory.dmp