guloader | 6a43e959a6b6ac945b6e2fd64cefc457cb2a87c76ccdcb139b1c9b457b75dbf4

General

Target

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Size

353KB
MD5

7fb6a8bbcc54cc1619ffd51aa9818fd6
SHA1

1bce717878bbc4e5638ca3fcc8179addd64a77fb
SHA256

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b
SHA512

9f3a56a2d642b940d01438783604c374017e9a94114a4298e957c047ca3ddbdccd5d360e5003a5f6b588e8429f5938081a338470d9a2981216b9870aeffb1032
SSDEEP

6144:ZsKxNX1AZr4pmt/DjcT3VMgEWM9Ks1i6bgQz8N6IjXjuPD:JWZr4pmtbjcT3ygK/11bR8NVoD

Score

10^/10

guloader lokibot collection downloader spyware stealer trojan

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 64 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid	process
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

33 drive.google.com
34 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

4968 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4968 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exeb187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

4980 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4968 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

flow	ioc
33	drive.google.com
34	drive.google.com

pid	process
4968	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
4968	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process	target process
PID 4980 set thread context of 4968	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Drops file in Windows directory 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description ioc process

File opened for modification C:\Windows\resources\frontalangrebs\appetizer.ini b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

4980 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid process

4968 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description pid process

Token: SeDebugPrivilege 4968 b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
File opened for modification	C:\Windows\resources\frontalangrebs\appetizer.ini	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

pid	process
4968	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process
Token: SeDebugPrivilege	4968	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	pid	process	target process
PID 4980 wrote to memory of 1728	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1728	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1728	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4712	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4712	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4712	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2804	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2804	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2804	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4788	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4788	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4788	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2996	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2996	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2996	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 3040	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 3040	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 3040	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4368	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4368	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4368	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4872	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4872	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4872	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4064	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4064	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4064	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2068	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2068	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2068	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4768	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4768	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4768	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 632	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 632	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 632	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1744	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1744	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1744	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4888	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4888	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4888	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2676	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2676	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2676	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 3212	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 3212	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 3212	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1800	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1800	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1800	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2100	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2100	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 2100	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1964	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1964	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1964	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1680	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1680	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 1680	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4176	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4176	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4176	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe
PID 4980 wrote to memory of 4364	4980	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe	cmd.exe

outlook_office_path 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

outlook_win_path 1 IoCs

Processes:

b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe

C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
"C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:1728

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:4712

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:4788

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:2996

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:3040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:4368

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:4872

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:4768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:4888

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:2676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:3212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:1800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2100

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:4176

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:4364

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "220^177"
2⤵
PID:4428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2540

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:2484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1048

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:5064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:2592

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:624

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3456

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4332

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3876

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1272

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1728

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:4044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3624

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4368

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:4432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4336

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:1736

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:4560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:5088

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4048

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4292

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4356

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:1460

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:772

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:4576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:4064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:5008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1672

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:4768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:1556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:1980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:3172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:3876

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "231^177"
2⤵
PID:1532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:5060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:2540

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:2664

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:4824

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1472

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:4312

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:2816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:3180

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3724

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:5032

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4248

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:216

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:1448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:3980

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:3976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:3520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4296

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:400

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4304

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3732

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1932

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:3180

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4116

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:5032

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4248

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1396

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
2⤵
PID:628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:1888

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:3176

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
2⤵
PID:1636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:4544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1404

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:60

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:516

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:4776

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:4324

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:3188

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:772

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1336

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:4608

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:2620

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "226^177"
2⤵
PID:2708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:3228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:2476

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:2468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2880

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:1564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:4816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:2264

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4480

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:2984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
2⤵
PID:3512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:4368

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:2440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:3152

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:2496

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2328

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4528

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2348

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:1448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:3120

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
2⤵
PID:3524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4844

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:5088

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1128

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4508

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2084

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:4312

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1868

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:2684

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:3428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:5008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
2⤵
PID:2892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:4768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:1556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
2⤵
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
2⤵
PID:1448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
2⤵
PID:4592

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:3448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:2880

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:1564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4624

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
2⤵
PID:4292

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:2540

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:3740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:2984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
2⤵
PID:1052

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:3552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:1628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:4212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3180

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:4116

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:540

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1056

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2324

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4724

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:2384

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:3200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4880

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:1304

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
2⤵
PID:4440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:4480

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
2⤵
PID:1908

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
2⤵
PID:4356

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
2⤵
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:620

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4840

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:3956

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "155^177"
2⤵
PID:3108

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4016

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:624

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2900

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4804

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4332

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:2100

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
2⤵
PID:1272

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:3996

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:4704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
2⤵
PID:400

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "194^177"
2⤵
PID:4896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
2⤵
PID:4868

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:3768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
2⤵
PID:2044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
2⤵
PID:4676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
2⤵
PID:4872

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
2⤵
PID:5064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
2⤵
PID:2688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:5008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
2⤵
PID:704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "230^177"
2⤵
PID:2892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4888

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
2⤵
PID:1556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
2⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:2252

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "198^177"
2⤵
PID:4184

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
2⤵
PID:4392

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
2⤵
PID:644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
2⤵
PID:3856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
2⤵
PID:4796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
2⤵
PID:4160

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
2⤵
PID:1460

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
2⤵
PID:4500

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:4872

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1672

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4596

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:2536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4940

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:3464

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:4844

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
2⤵
PID:1780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:3964

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
2⤵
PID:1636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
2⤵
PID:4960

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
2⤵
PID:60

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
2⤵
PID:1944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
2⤵
PID:2672

C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe
"C:\Users\Admin\AppData\Local\Temp\b187478ed3f00d2157b587ff89b0241c3db74e50370bb3b5e25aac165a09891b.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4968

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso4315.tmp\System.dll
Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso4315.tmp\nsExec.dll
Filesize
6KB

MD5
8d4278d0b0af44c989ed14ea40b75e06

SHA1
072f92761b281bc20d0bc3b3486251f60e6c259f

SHA256
9c50ba10ff8009137ad005aee7bdcace042ff343b37e11cd6ca45a6186ae977e

SHA512
1a22c3aa8ea1ff980b5c7812f75a9369cfd74f2b780039e79c0c52eb00cb019bac6f860e97a7279f0c8e4c890e5dd1bca31e69d6548fc73397d4fa05c8b12542

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19
Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19
Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
memory/4968-1261-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4968-1274-0x0000000001660000-0x0000000004AB8000-memory.dmp

Filesize
52.3MB

Download
memory/4980-1260-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads