guloader | b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b

General

Target

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Size

353KB
MD5

7fb6a8bbcc54cc1619ffd51aa9818fd6
SHA1

1bce717878bbc4e5638ca3fcc8179addd64a77fb
SHA256

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b
SHA512

9f3a56a2d642b940d01438783604c374017e9a94114a4298e957c047ca3ddbdccd5d360e5003a5f6b588e8429f5938081a338470d9a2981216b9870aeffb1032
SSDEEP

6144:ZsKxNX1AZr4pmt/DjcT3VMgEWM9Ks1i6bgQz8N6IjXjuPD:JWZr4pmtbjcT3ygK/11bR8NVoD

Score

10^/10

guloader lokibot collection downloader spyware stealer trojan

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 64 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid	process
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 drive.google.com
5 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

1600 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1600 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exeb187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

2384 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1600 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

flow	ioc
3	drive.google.com
5	drive.google.com

pid	process
1600	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
1600	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process	target process
PID 2384 set thread context of 1600	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Drops file in Windows directory 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description ioc process

File opened for modification C:\Windows\resources\frontalangrebs\appetizer.ini b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

2384 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

1600 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description pid process

Token: SeDebugPrivilege 1600 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
File opened for modification	C:\Windows\resources\frontalangrebs\appetizer.ini	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid	process
1600	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process
Token: SeDebugPrivilege	1600	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process	target process
PID 2384 wrote to memory of 2132	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2132	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2132	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2132	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2932	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2932	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2932	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2932	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2944	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2944	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2944	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2944	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2612	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2612	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2612	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2612	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2876	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2876	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2876	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2876	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2660	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2660	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2660	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2660	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2488	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2488	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2488	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2488	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2092	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2092	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2092	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2092	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2844	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2844	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2844	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2844	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2860	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2860	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2860	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2860	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2900	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2900	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2900	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2900	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 496	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 496	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 496	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 496	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1784	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1784	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1784	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1784	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1628	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1628	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1628	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1628	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1552	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1552	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1552	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 1552	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2736	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2736	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2736	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2384 wrote to memory of 2736	2384	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe

outlook_office_path 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

outlook_win_path 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
"C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:2132

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2932

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2612

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2876

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2488

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2844

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:2900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:496

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:1628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2736

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:3056

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1312

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:3044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2828

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:2956

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2304

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "220^177"
2⤵
PID:1160

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:584

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1732

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:904

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:2980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2252

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2672

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2260

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2864

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:2912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1792

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:752

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2776

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:824

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:1120

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:3040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:1264

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:2936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2156

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:1588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2392

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2820

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2368

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2500

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2612

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2540

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "231^177"
2⤵
PID:2796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:2848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:2888

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:2556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:2772

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1296

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:1156

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1120

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:3040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:2228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:316

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2352

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2156

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2392

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1932

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2132

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2808

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2224

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:2540

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:2560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:2848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2868

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:2884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:1092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2772

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:3064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2828

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2472

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "226^177"
2⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:2940

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:2460

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:1664

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:1868

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:1976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2052

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1612

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2364

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2348

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2700

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2932

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:1652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:2728

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1672

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2280

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3000

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:752

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:1504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2760

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:1804

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:820

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:1924

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:2952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2116

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2304

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:1112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2248

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:1084

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:1012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:1732

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:1348

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:1264

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:2976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1756

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1716

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2156

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2820

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2500

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2516

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1808

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1824

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2888

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:1252

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:1044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:2320

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3056

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2336

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "155^177"
2⤵
PID:3060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1248

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1160

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2344

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:1816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1340

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1788

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:904

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:1528

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "194^177"
2⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:1712

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2920

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2136

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2916

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:2704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:2652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "230^177"
2⤵
PID:2672

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:2496

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:2488

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:1072

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "198^177"
2⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:1572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:1628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2756

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:1332

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3036

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1924

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1296

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1776

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1364

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1732

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1348

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:992

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2188

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2328

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2164

C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
"C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3691908287-3775019229-3534252667-1000\0f5007522459c86e95ffcc62f32308f1_a42634aa-f501-41cf-bed1-b8158857da02
Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3691908287-3775019229-3534252667-1000\0f5007522459c86e95ffcc62f32308f1_a42634aa-f501-41cf-bed1-b8158857da02
Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1A45.tmp\System.dll
Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1A45.tmp\nsExec.dll
Filesize
6KB

MD5
8d4278d0b0af44c989ed14ea40b75e06

SHA1
072f92761b281bc20d0bc3b3486251f60e6c259f

SHA256
9c50ba10ff8009137ad005aee7bdcace042ff343b37e11cd6ca45a6186ae977e

SHA512
1a22c3aa8ea1ff980b5c7812f75a9369cfd74f2b780039e79c0c52eb00cb019bac6f860e97a7279f0c8e4c890e5dd1bca31e69d6548fc73397d4fa05c8b12542

Download Submit
memory/1600-969-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1600-973-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1600-993-0x0000000001470000-0x00000000048C8000-memory.dmp

Filesize
52.3MB

Download
memory/2384-968-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads