72dcf3b5d7cd9832908d30bc412ada04e8ed3124e66494d14c6f0714e44dee22

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/10/2026, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
72dcf3b5d7cd9832.bin.exe
Size 1.9MB
Sample261019-btnsfswv2n
SHA256 72dcf3b5d7cd9832908d30bc412ada04e8ed3124e66494d14c6f0714e44dee22
MD5 99020755659ea520b8b2c3be32433e39
SHA1 16ebd4e325591813194289009c0ee0a2f94e43ea
SHA512 f85d45a055886069347de588feb99d44e59f83839b8ce304462293cb61c3a4f9128090014b39cec07167786819900bfdda1422cdd6869e24cc19b297785b5d12
SSDEEP 24576:5RfqQSFbnTwprZMo9wxGmUGJZ4bkFFJ8dtAGcMVTvHdOmdVIH06iy9FMsYX:5oQSVqrZMoob4bkFJ8oGrVBbIU6isvW
TLSH
T1B9956D03F69580FCC55EC1788347A632EA22BC8E092576EB27D09B253E76F915F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Security Service 334 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\72dcf3b5d7cd9832.bin.exe"	72dcf3b5d7cd9832.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Provider 444 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\72dcf3b5d7cd9832.bin.exe"	72dcf3b5d7cd9832.bin.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	api.ipify.org
4	api.ipify.org
13	api.ipify.org

Executes a command shell one-liner 1 TTPs 50 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6052	cmd.exe
5012	cmd.exe
1804	cmd.exe
1096	cmd.exe
4844	cmd.exe
1576	cmd.exe
1764	cmd.exe
3260	cmd.exe
1604	cmd.exe
4904	cmd.exe
4428	cmd.exe
5688	cmd.exe
4332	cmd.exe
6064	cmd.exe
3064	cmd.exe
4996	cmd.exe
4172	cmd.exe
4164	cmd.exe
4976	cmd.exe
4692	cmd.exe
980	cmd.exe
2080	cmd.exe
5712	cmd.exe
1052	cmd.exe
2188	cmd.exe
6076	cmd.exe
4836	cmd.exe
3452	cmd.exe
4896	cmd.exe
4900	cmd.exe
4604	cmd.exe
5672	cmd.exe
3824	cmd.exe
1600	cmd.exe
1384	cmd.exe
2076	cmd.exe
4964	cmd.exe
2224	cmd.exe
628	cmd.exe
5676	cmd.exe
2040	cmd.exe
1312	cmd.exe
2392	cmd.exe
4668	cmd.exe
5692	cmd.exe
1860	cmd.exe
2968	cmd.exe
4932	cmd.exe
3684	cmd.exe
764	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	72dcf3b5d7cd9832.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	72dcf3b5d7cd9832.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	72dcf3b5d7cd9832.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	72dcf3b5d7cd9832.bin.exe

Gathers network information 2 TTPs 50 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4912	ipconfig.exe
5568	ipconfig.exe
4152	ipconfig.exe
388	ipconfig.exe
4132	ipconfig.exe
4436	ipconfig.exe
3748	ipconfig.exe
3640	ipconfig.exe
5172	ipconfig.exe
4520	ipconfig.exe
4160	ipconfig.exe
2432	ipconfig.exe
620	ipconfig.exe
5540	ipconfig.exe
1800	ipconfig.exe
4596	ipconfig.exe
4736	ipconfig.exe
5348	ipconfig.exe
748	ipconfig.exe
4156	ipconfig.exe
5468	ipconfig.exe
2508	ipconfig.exe
1620	ipconfig.exe
404	ipconfig.exe
5172	ipconfig.exe
3576	ipconfig.exe
3376	ipconfig.exe
5024	ipconfig.exe
3912	ipconfig.exe
5156	ipconfig.exe
1956	ipconfig.exe
1988	ipconfig.exe
5416	ipconfig.exe
440	ipconfig.exe
3872	ipconfig.exe
5340	ipconfig.exe
1320	ipconfig.exe
4460	ipconfig.exe
4476	ipconfig.exe
5140	ipconfig.exe
1676	ipconfig.exe
4280	ipconfig.exe
1628	ipconfig.exe
2408	ipconfig.exe
6124	ipconfig.exe
5440	ipconfig.exe
4060	ipconfig.exe
1808	ipconfig.exe
1272	ipconfig.exe
444	ipconfig.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2392	5072	72dcf3b5d7cd9832.bin.exe	87
PID 2392 wrote to memory of 1808	2392	cmd.exe	88
PID 5072 wrote to memory of 4692	5072	72dcf3b5d7cd9832.bin.exe	89
PID 4692 wrote to memory of 5172	4692	cmd.exe	90
PID 6028 wrote to memory of 4844	6028	72dcf3b5d7cd9832.bin.exe	93
PID 4844 wrote to memory of 5348	4844	cmd.exe	94
PID 6028 wrote to memory of 6052	6028	72dcf3b5d7cd9832.bin.exe	95
PID 6052 wrote to memory of 5140	6052	cmd.exe	96
PID 5072 wrote to memory of 4668	5072	72dcf3b5d7cd9832.bin.exe	103
PID 6028 wrote to memory of 3452	6028	72dcf3b5d7cd9832.bin.exe	102
PID 3452 wrote to memory of 1956	3452	cmd.exe	104
PID 4668 wrote to memory of 1272	4668	cmd.exe	105
PID 5072 wrote to memory of 980	5072	72dcf3b5d7cd9832.bin.exe	109
PID 6028 wrote to memory of 1384	6028	72dcf3b5d7cd9832.bin.exe	110
PID 980 wrote to memory of 444	980	cmd.exe	111
PID 1384 wrote to memory of 1320	1384	cmd.exe	112
PID 6028 wrote to memory of 2076	6028	72dcf3b5d7cd9832.bin.exe	113
PID 5072 wrote to memory of 2080	5072	72dcf3b5d7cd9832.bin.exe	114
PID 2076 wrote to memory of 1676	2076	cmd.exe	115
PID 2080 wrote to memory of 748	2080	cmd.exe	116
PID 6028 wrote to memory of 2224	6028	72dcf3b5d7cd9832.bin.exe	117
PID 5072 wrote to memory of 4964	5072	72dcf3b5d7cd9832.bin.exe	118
PID 4964 wrote to memory of 1988	4964	cmd.exe	119
PID 2224 wrote to memory of 4912	2224	cmd.exe	120
PID 5072 wrote to memory of 5688	5072	72dcf3b5d7cd9832.bin.exe	123
PID 6028 wrote to memory of 5712	6028	72dcf3b5d7cd9832.bin.exe	124
PID 5688 wrote to memory of 5568	5688	cmd.exe	125
PID 5712 wrote to memory of 5416	5712	cmd.exe	126
PID 6028 wrote to memory of 6064	6028	72dcf3b5d7cd9832.bin.exe	128
PID 5072 wrote to memory of 4332	5072	72dcf3b5d7cd9832.bin.exe	129
PID 4332 wrote to memory of 440	4332	cmd.exe	130
PID 6064 wrote to memory of 3576	6064	cmd.exe	131
PID 6028 wrote to memory of 1052	6028	72dcf3b5d7cd9832.bin.exe	133
PID 5072 wrote to memory of 628	5072	72dcf3b5d7cd9832.bin.exe	132
PID 1052 wrote to memory of 4156	1052	cmd.exe	134
PID 628 wrote to memory of 4132	628	cmd.exe	135
PID 6028 wrote to memory of 4996	6028	72dcf3b5d7cd9832.bin.exe	136
PID 5072 wrote to memory of 3064	5072	72dcf3b5d7cd9832.bin.exe	137
PID 3064 wrote to memory of 4280	3064	cmd.exe	138
PID 4996 wrote to memory of 4160	4996	cmd.exe	139
PID 6028 wrote to memory of 5676	6028	72dcf3b5d7cd9832.bin.exe	140
PID 5072 wrote to memory of 1576	5072	72dcf3b5d7cd9832.bin.exe	141
PID 5676 wrote to memory of 4436	5676	cmd.exe	142
PID 1576 wrote to memory of 2432	1576	cmd.exe	143
PID 6028 wrote to memory of 2040	6028	72dcf3b5d7cd9832.bin.exe	145
PID 5072 wrote to memory of 5012	5072	72dcf3b5d7cd9832.bin.exe	144
PID 5012 wrote to memory of 3376	5012	cmd.exe	146
PID 2040 wrote to memory of 5468	2040	cmd.exe	147
PID 5072 wrote to memory of 4172	5072	72dcf3b5d7cd9832.bin.exe	148
PID 6028 wrote to memory of 2188	6028	72dcf3b5d7cd9832.bin.exe	149
PID 4172 wrote to memory of 2508	4172	cmd.exe	150
PID 2188 wrote to memory of 5024	2188	cmd.exe	151
PID 5072 wrote to memory of 1804	5072	72dcf3b5d7cd9832.bin.exe	153
PID 6028 wrote to memory of 5692	6028	72dcf3b5d7cd9832.bin.exe	152
PID 1804 wrote to memory of 4152	1804	cmd.exe	154
PID 5692 wrote to memory of 620	5692	cmd.exe	155
PID 5072 wrote to memory of 1096	5072	72dcf3b5d7cd9832.bin.exe	156
PID 6028 wrote to memory of 4896	6028	72dcf3b5d7cd9832.bin.exe	157
PID 4896 wrote to memory of 4460	4896	cmd.exe	158
PID 1096 wrote to memory of 5540	1096	cmd.exe	159
PID 6028 wrote to memory of 4164	6028	72dcf3b5d7cd9832.bin.exe	161
PID 5072 wrote to memory of 4976	5072	72dcf3b5d7cd9832.bin.exe	160
PID 4976 wrote to memory of 388	4976	cmd.exe	162
PID 4164 wrote to memory of 3912	4164	cmd.exe	163

C:\Users\Admin\AppData\Local\Temp\72dcf3b5d7cd9832.bin.exe
"C:\Users\Admin\AppData\Local\Temp\72dcf3b5d7cd9832.bin.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1808
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5172
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1272
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:444
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:748
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1988
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5568
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:440
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4132
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4280
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3376
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2508
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4152
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5540
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:388
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1860
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1628
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:6076
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:2408
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3260
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5440
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4604
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5340
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:2968
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1800
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4904
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4596
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:5672
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4476
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:764
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4736
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3684
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4520

C:\Users\Admin\AppData\Local\Temp\72dcf3b5d7cd9832.bin.exe
C:\Users\Admin\AppData\Local\Temp\72dcf3b5d7cd9832.bin.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5348
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5140
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1956
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1320
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1676
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4912
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5416
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3576
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4156
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4160
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4436
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5468
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5024
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:620
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4460
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3912
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1312
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3748
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1764
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:6124
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4836
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3872
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4900
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4060
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4932
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5156
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1604
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:1620
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:4428
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3640
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:3824
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:404
- C:\Windows\system32\cmd.exe
  "cmd" /C ipconfig
  2⤵
  - Executes a command shell one-liner
  PID:1600
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5072-6-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-12-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-2-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-24-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-4-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-22-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-8-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-14-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-26-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-20-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-10-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-18-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-0-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/5072-16-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-7-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-15-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-13-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-17-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-11-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-19-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-9-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-21-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-5-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-23-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-3-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-25-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-1-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

memory/6028-27-0x00007FF7E62D0000-0x00007FF7E64B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads