01 / TRADECRAFT
1 examplesCommand reference
Execute1
EXAMPLE 01T1202
Execute executable with wlrmdr.exe as parent process
COMMAND
wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u {PATH:.exe}02 / ON DISK
Known paths
c:\windows\system32\wlrmdr.exe03 / DEFENSIVE INTELLIGENCE
1 resourcesDetection & indicators
Indicators & detection notes
- IOC
wlrmdr.exe spawning any new processes
FURTHER READING
Research & resources
COMMUNITY RESEARCH
Acknowledgements
Grzegorz Tworek@0gtweet
Oddvar Moe@Oddvarmoe
Freddy@falsneg