Analysis
- max time kernel
150s - max time network
72s - platform
windows7_x64 - resource
win7 - submitted
24/06/2020, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe
- Size 932KB
- Sample200624-v7pg8gxvbx
- SHA256 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9
- MD5 1dc80685c258916d30f9bf2365d76ff5
- SHA1 bc0111105913d61308b5164833d31574d0391543
- SHA512 7bf344038fc679919f30f93070c666c5409d76f81b8a79cf6aeda9d356ad7b9b570de0e994b4dd20096e3b3869b63ad496361f08bbd24eaa3eea6580aa965ba2
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Test Server
C2
-
127.0.0.1:1604
Mutex
-
DC_MUTEX-4XKPULH
Attributes
-
gencode
LBSgYfRa7QDe
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" STEWART LOGO.EXE - Executes dropped EXE 6 IoCs
pid Process 1304 taskmgr.exe 1548 STEWART LOGO.EXE 1224 STEWART LOGO.EXE 1608 svchost.com 1892 notepad.exe 564 svchost.com - Loads dropped DLL 13 IoCs
pid Process 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 1304 taskmgr.exe 1304 taskmgr.exe 1548 STEWART LOGO.EXE 1548 STEWART LOGO.EXE 1548 STEWART LOGO.EXE 1548 STEWART LOGO.EXE 1548 STEWART LOGO.EXE 1224 STEWART LOGO.EXE 1608 svchost.com 1608 svchost.com 1608 svchost.com 564 svchost.com - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\facebook.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\facebook.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1032 set thread context of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1224 set thread context of 1892 1224 STEWART LOGO.EXE 34 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Temp\GUM2396.tmp\GOFB2B~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\CHROME~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe svchost.com File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE svchost.com File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe svchost.com File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\chrome.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE svchost.com File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe svchost.com File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE svchost.com File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\INSTAL~1\setup.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\NOTIFI~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe svchost.com File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe svchost.com File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe svchost.com File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\CHROME~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\ELEVAT~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe svchost.com File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe svchost.com File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE STEWART LOGO.EXE - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com STEWART LOGO.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" STEWART LOGO.EXE - Modifies registry key 1 TTPs 2 IoCs
pid Process 1364 reg.exe 1944 reg.exe - Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe Token: SeDebugPrivilege 1224 STEWART LOGO.EXE Token: SeIncreaseQuotaPrivilege 1892 notepad.exe Token: SeSecurityPrivilege 1892 notepad.exe Token: SeTakeOwnershipPrivilege 1892 notepad.exe Token: SeLoadDriverPrivilege 1892 notepad.exe Token: SeSystemProfilePrivilege 1892 notepad.exe Token: SeSystemtimePrivilege 1892 notepad.exe Token: SeProfSingleProcessPrivilege 1892 notepad.exe Token: SeIncBasePriorityPrivilege 1892 notepad.exe Token: SeCreatePagefilePrivilege 1892 notepad.exe Token: SeBackupPrivilege 1892 notepad.exe Token: SeRestorePrivilege 1892 notepad.exe Token: SeShutdownPrivilege 1892 notepad.exe Token: SeDebugPrivilege 1892 notepad.exe Token: SeSystemEnvironmentPrivilege 1892 notepad.exe Token: SeChangeNotifyPrivilege 1892 notepad.exe Token: SeRemoteShutdownPrivilege 1892 notepad.exe Token: SeUndockPrivilege 1892 notepad.exe Token: SeManageVolumePrivilege 1892 notepad.exe Token: SeImpersonatePrivilege 1892 notepad.exe Token: SeCreateGlobalPrivilege 1892 notepad.exe Token: 33 1892 notepad.exe Token: 34 1892 notepad.exe Token: 35 1892 notepad.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 276 DllHost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1892 notepad.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1204 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 24 PID 1032 wrote to memory of 1204 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 24 PID 1032 wrote to memory of 1204 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 24 PID 1032 wrote to memory of 1204 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 24 PID 1204 wrote to memory of 1364 1204 cmd.exe 26 PID 1204 wrote to memory of 1364 1204 cmd.exe 26 PID 1204 wrote to memory of 1364 1204 cmd.exe 26 PID 1204 wrote to memory of 1364 1204 cmd.exe 26 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1032 wrote to memory of 1304 1032 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 27 PID 1304 wrote to memory of 1548 1304 taskmgr.exe 29 PID 1304 wrote to memory of 1548 1304 taskmgr.exe 29 PID 1304 wrote to memory of 1548 1304 taskmgr.exe 29 PID 1304 wrote to memory of 1548 1304 taskmgr.exe 29 PID 1548 wrote to memory of 1224 1548 STEWART LOGO.EXE 30 PID 1548 wrote to memory of 1224 1548 STEWART LOGO.EXE 30 PID 1548 wrote to memory of 1224 1548 STEWART LOGO.EXE 30 PID 1548 wrote to memory of 1224 1548 STEWART LOGO.EXE 30 PID 1224 wrote to memory of 1608 1224 STEWART LOGO.EXE 31 PID 1224 wrote to memory of 1608 1224 STEWART LOGO.EXE 31 PID 1224 wrote to memory of 1608 1224 STEWART LOGO.EXE 31 PID 1224 wrote to memory of 1608 1224 STEWART LOGO.EXE 31 PID 1608 wrote to memory of 1660 1608 svchost.com 32 PID 1608 wrote to memory of 1660 1608 svchost.com 32 PID 1608 wrote to memory of 1660 1608 svchost.com 32 PID 1608 wrote to memory of 1660 1608 svchost.com 32 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1224 wrote to memory of 1892 1224 STEWART LOGO.EXE 34 PID 1660 wrote to memory of 1944 1660 cmd.exe 35 PID 1660 wrote to memory of 1944 1660 cmd.exe 35 PID 1660 wrote to memory of 1944 1660 cmd.exe 35 PID 1660 wrote to memory of 1944 1660 cmd.exe 35 PID 1224 wrote to memory of 564 1224 STEWART LOGO.EXE 36 PID 1224 wrote to memory of 564 1224 STEWART LOGO.EXE 36 PID 1224 wrote to memory of 564 1224 STEWART LOGO.EXE 36 PID 1224 wrote to memory of 564 1224 STEWART LOGO.EXE 36 PID 564 wrote to memory of 568 564 svchost.com 37 PID 564 wrote to memory of 568 564 svchost.com 37 PID 564 wrote to memory of 568 564 svchost.com 37 PID 564 wrote to memory of 568 564 svchost.com 37 PID 568 wrote to memory of 1376 568 cmd.exe 39 PID 568 wrote to memory of 1376 568 cmd.exe 39 PID 568 wrote to memory of 1376 568 cmd.exe 39 PID 568 wrote to memory of 1376 568 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe"C:\Users\Admin\AppData\Local\Temp\c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V chrome.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V chrome.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\chrome.exe3⤵
- Adds Run key to start application
- Modifies registry key
PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskmgr.exeC:\Users\Admin\AppData\Local\Temp\taskmgr.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\STEWART LOGO.EXE"C:\Users\Admin\AppData\Local\Temp\STEWART LOGO.EXE"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE"C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V facebook.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\facebook.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V facebook.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\facebook.exe6⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V facebook.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\facebook.exe7⤵
- Adds Run key to start application
- Modifies registry key
PID:1944
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\notepad.exeC:\Users\Admin\AppData\Local\Temp\notepad.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE6⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 37⤵PID:1376
-
-
-
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:276