Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 03:07
Static task
static1
Behavioral task
behavioral1
Sample
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
General
-
Target
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe
-
Size
314KB
-
MD5
c7ceecb921d43912ec928af816a43ede
-
SHA1
2c4266ebdae98fc609ffb191cf26e85dc0671faa
-
SHA256
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86
-
SHA512
8b4ecfc89221af3d4dde2ab7effc288f9c9ddaba764b67acbde33fbc5c19d69e16d69c40f35de74e36f4eb12bdd2ffba44b702bea9d5249476dafc7f4f389e31
-
SSDEEP
6144:BXFKo5F4CtVeI8Y9BA6MA4ph2LN7LNNhEdMUjzz4elzC:BX54CVeI8Y9BA6uph2LN7LNNhTelO
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/4984-1204-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral2/memory/4984-1207-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4460-1203-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4460-1206-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4460-1219-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral2/memory/4984-1204-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/4460-1203-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/5740-1213-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/5740-1216-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/5740-1215-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4984-1207-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/4460-1206-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/4460-1219-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe -
Executes dropped EXE 4 IoCs
Processes:
QQ.exeQQ.exeQQ.exeQQ.exepid process 4844 QQ.exe 4460 QQ.exe 4984 QQ.exe 5740 QQ.exe -
Loads dropped DLL 64 IoCs
Processes:
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exepid process 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
QQ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts QQ.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exeQQ.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\"" 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\"" QQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\"" QQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\"" 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs
Processes:
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exeQQ.exepid process 2912 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2912 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 4048 QQ.exe 4048 QQ.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exeQQ.exeQQ.exepid process 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 2912 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 4844 QQ.exe 4048 QQ.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exeQQ.exeQQ.exedescription pid process target process PID 2712 set thread context of 2912 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe PID 4844 set thread context of 4048 4844 QQ.exe QQ.exe PID 4048 set thread context of 4460 4048 QQ.exe QQ.exe PID 4048 set thread context of 4984 4048 QQ.exe QQ.exe PID 4048 set thread context of 5740 4048 QQ.exe QQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
QQ.exeQQ.exepid process 4460 QQ.exe 4460 QQ.exe 5740 QQ.exe 5740 QQ.exe 4460 QQ.exe 4460 QQ.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exeQQ.exeQQ.exepid process 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe 4844 QQ.exe 4048 QQ.exe 4048 QQ.exe 4048 QQ.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
QQ.exedescription pid process Token: SeDebugPrivilege 5740 QQ.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
QQ.exepid process 4048 QQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exedescription pid process target process PID 2712 wrote to memory of 3020 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 3020 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 3020 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5616 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5616 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5616 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 4736 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 4736 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 4736 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5572 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5572 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5572 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2248 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2248 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2248 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5664 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5664 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5664 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5196 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5196 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5196 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5696 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5696 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5696 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2356 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2356 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2356 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 3888 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 3888 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 3888 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 996 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 996 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 996 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2184 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2184 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2184 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 956 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 956 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 956 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 4564 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 4564 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 4564 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5960 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5960 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5960 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 1656 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 1656 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 1656 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2524 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2524 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2524 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 3504 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 3504 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 3504 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2596 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2596 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2596 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2364 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2364 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 2364 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 1120 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 1120 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 1120 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe PID 2712 wrote to memory of 5256 2712 144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe"C:\Users\Admin\AppData\Local\Temp\144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵
-
C:\Users\Admin\AppData\Local\Temp\144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe"C:\Users\Admin\AppData\Local\Temp\144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exe"C:\Users\Admin\AppData\Roaming\QQ\QQ.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"4⤵
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exe"C:\Users\Admin\AppData\Roaming\QQ\QQ.exe"4⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exeC:\Users\Admin\AppData\Roaming\QQ\QQ.exe /stext "C:\Users\Admin\AppData\Local\Temp\eelxsmpzfzqwszxyelkxui"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exeC:\Users\Admin\AppData\Roaming\QQ\QQ.exe /stext "C:\Users\Admin\AppData\Local\Temp\oyqpteaathibcntcnoxzfnfgz"5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exeC:\Users\Admin\AppData\Roaming\QQ\QQ.exe /stext "C:\Users\Admin\AppData\Local\Temp\yavauxkuhpbnethgezjaiazpicwxc"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD597f9631c3a015273ebe1212441784cc4
SHA1e65eeb7314f374132d61e29e01696dd14f43794a
SHA256bb829451aa735fe1b7442ac4fa2a62c8408edb3ef750735dcadfed1e5ba86377
SHA5124f117d5b6b898a435b2657587f36731a4fb42065ee8e3daed039839b004366eb60d8bf5764b06a6485e7b7fa7b6034fe5676d33d80c08ad1d86c3d780cccb6a5
-
C:\Users\Admin\AppData\Local\Temp\nsg493F.tmp\System.dllFilesize
12KB
MD54add245d4ba34b04f213409bfe504c07
SHA1ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA2569111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA5121bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
-
C:\Users\Admin\AppData\Local\Temp\nsg493F.tmp\nsExec.dllFilesize
7KB
MD5b4579bc396ace8cafd9e825ff63fe244
SHA132a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
SHA25601e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
SHA5123a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exeFilesize
314KB
MD5c7ceecb921d43912ec928af816a43ede
SHA12c4266ebdae98fc609ffb191cf26e85dc0671faa
SHA256144540da6bfc395bdd8726b156099a7f7b27240321424411ba8af877cbdcbe86
SHA5128b4ecfc89221af3d4dde2ab7effc288f9c9ddaba764b67acbde33fbc5c19d69e16d69c40f35de74e36f4eb12bdd2ffba44b702bea9d5249476dafc7f4f389e31
-
memory/2912-629-0x00000000016D0000-0x00000000037C2000-memory.dmpFilesize
32.9MB
-
memory/2912-639-0x00000000016D0000-0x00000000037C2000-memory.dmpFilesize
32.9MB
-
memory/4048-1224-0x00000000347A0000-0x00000000347B9000-memory.dmpFilesize
100KB
-
memory/4048-1197-0x00000000016D0000-0x00000000037C2000-memory.dmpFilesize
32.9MB
-
memory/4048-1221-0x00000000347A0000-0x00000000347B9000-memory.dmpFilesize
100KB
-
memory/4048-1225-0x00000000347A0000-0x00000000347B9000-memory.dmpFilesize
100KB
-
memory/4460-1199-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4460-1203-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4460-1200-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4460-1219-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4460-1206-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4984-1201-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/4984-1207-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/4984-1202-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/4984-1204-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/5740-1209-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5740-1215-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5740-1216-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5740-1213-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5740-1208-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB