guloader | 6a43e959a6b6ac945b6e2fd64cefc457cb2a87c76ccdcb139b1c9b457b75dbf4

General

Target

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Size

353KB
MD5

7fb6a8bbcc54cc1619ffd51aa9818fd6
SHA1

1bce717878bbc4e5638ca3fcc8179addd64a77fb
SHA256

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b
SHA512

9f3a56a2d642b940d01438783604c374017e9a94114a4298e957c047ca3ddbdccd5d360e5003a5f6b588e8429f5938081a338470d9a2981216b9870aeffb1032
SSDEEP

6144:ZsKxNX1AZr4pmt/DjcT3VMgEWM9Ks1i6bgQz8N6IjXjuPD:JWZr4pmtbjcT3ygK/11bR8NVoD

Score

10^/10

guloader lokibot collection downloader spyware stealer trojan

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 64 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid	process
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 drive.google.com
5 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

2636 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2636 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exeb187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

2912 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2636 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

flow	ioc
3	drive.google.com
5	drive.google.com

pid	process
2636	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
2636	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process	target process
PID 2912 set thread context of 2636	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Drops file in Windows directory 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description ioc process

File opened for modification C:\Windows\resources\frontalangrebs\appetizer.ini b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

2912 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

2636 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description pid process

Token: SeDebugPrivilege 2636 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
File opened for modification	C:\Windows\resources\frontalangrebs\appetizer.ini	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid	process
2636	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process
Token: SeDebugPrivilege	2636	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process	target process
PID 2912 wrote to memory of 2616	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2616	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2616	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2616	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2156	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2156	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2156	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2156	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2864	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2864	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2864	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2864	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2576	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2576	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2576	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2576	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1720	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1720	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1720	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1720	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2356	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2356	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2356	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2356	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2800	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2800	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2800	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2800	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2808	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2808	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2808	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2808	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 296	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 296	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 296	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 296	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2072	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2072	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2072	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 2072	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1344	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1344	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1344	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1344	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 900	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 900	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 900	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 900	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1744	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1744	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1744	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1744	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1740	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1740	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1740	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1740	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1248	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1248	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1248	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 1248	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 856	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 856	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 856	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 2912 wrote to memory of 856	2912	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe

outlook_office_path 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

outlook_win_path 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
"C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:2616

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2156

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2864

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2808

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:296

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2072

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:1344

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:1740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:1248

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2152

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "220^177"
2⤵
PID:812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:920

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1460

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2052

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2324

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:2132

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:1424

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2480

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1656

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:624

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:2100

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2124

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:2436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2920

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:700

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:836

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:2872

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:2308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2056

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:908

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2000

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:1992

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2844

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2496

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2348

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:1656

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2220

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2264

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "231^177"
2⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:1260

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:356

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1248

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2160

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1732

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:672

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:920

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:1192

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:2224

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2324

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1424

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2488

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2616

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2528

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2460

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:2412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2932

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2236

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:1448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:2316

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:1500

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:1532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:868

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:1200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:480

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:1396

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2584

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "226^177"
2⤵
PID:836

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1196

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:2592

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:3060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:1572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:840

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2888

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2844

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2456

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2476

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:2296

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:2116

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2252

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1256

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1248

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2160

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:2944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2084

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1480

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2960

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2728

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:1476

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:1280

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:332

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2076

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:1872

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:1992

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2480

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2732

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2640

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1820

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2664

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2788

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2120

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:1876

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2072

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2400

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1188

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:2588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1348

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2180

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1408

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "155^177"
2⤵
PID:980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:836

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1196

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1132

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1236

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2052

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:2000

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:992

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:1632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "194^177"
2⤵
PID:2996

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2456

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2528

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:2344

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:2416

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "230^177"
2⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2932

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:2236

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:1448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:1260

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "198^177"
2⤵
PID:356

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:2516

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:852

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:2524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2164

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:324

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:920

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:332

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2420

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2156

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2612

C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
"C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2636

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2721934792-624042501-2768869379-1000\0f5007522459c86e95ffcc62f32308f1_dbaf3979-518f-4824-86e4-f33db9fb991c
Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2721934792-624042501-2768869379-1000\0f5007522459c86e95ffcc62f32308f1_dbaf3979-518f-4824-86e4-f33db9fb991c
Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1047.tmp\System.dll
Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1047.tmp\nsExec.dll
Filesize
6KB

MD5
8d4278d0b0af44c989ed14ea40b75e06

SHA1
072f92761b281bc20d0bc3b3486251f60e6c259f

SHA256
9c50ba10ff8009137ad005aee7bdcace042ff343b37e11cd6ca45a6186ae977e

SHA512
1a22c3aa8ea1ff980b5c7812f75a9369cfd74f2b780039e79c0c52eb00cb019bac6f860e97a7279f0c8e4c890e5dd1bca31e69d6548fc73397d4fa05c8b12542

Download Submit
memory/2636-971-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2636-993-0x0000000001470000-0x00000000048C8000-memory.dmp

Filesize
52.3MB

Download
memory/2912-970-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads