Analysis
- max time kernel
151s - max time network
139s - platform
windows7_x64 - resource
win7 - submitted
31/08/2020, 05:21
Static task
static1
Behavioral task
behavioral1
Sample
a29eef18539cc9cf7ef1f3e57ee96979.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a29eef18539cc9cf7ef1f3e57ee96979.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target a29eef18539cc9cf7ef1f3e57ee96979.exe
- Size 980KB
- Sample200831-9py7a6p3b2
- SHA256 1d51976f93b1fb65c446f7e27c4ebc1e865006883be720431e5129f2aed7325e
- MD5 a29eef18539cc9cf7ef1f3e57ee96979
- SHA1 a398dec5b088ca532195942e8ed2471226b80b31
- SHA512 e8fb0583af0396392fc5379e47ac69f6ce65c60cd2599cb682621013cea5cf3c130b2fe934676a2ca98ae52d47f5d4049c5a2149d490e50e96c5b8e9856f6aa9
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\E2C1E8F1FA\Log.txt
-
masslogger
Ransom Note
- <|| v2.1.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 8/31/2020 5:17:53 AM MassLogger Started: 8/31/2020 5:17:46 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Roaming\appdata\jkfljdgsglhd.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
yara_rule masslogger_log_file - Executes dropped EXE 3 IoCs
pid Process 1888 jkfljdgsglhd.exe 1372 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe -
resource yara_rule behavioral1/memory/1372-10-0x0000000000400000-0x0000000000542000-memory.dmp upx behavioral1/memory/1372-10-0x0000000000400000-0x0000000000542000-memory.dmp upx behavioral1/memory/1372-14-0x0000000000400000-0x0000000000542000-memory.dmp upx behavioral1/memory/1372-14-0x0000000000400000-0x0000000000542000-memory.dmp upx behavioral1/memory/1372-15-0x0000000000400000-0x0000000000542000-memory.dmp upx behavioral1/memory/1372-15-0x0000000000400000-0x0000000000542000-memory.dmp upx - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs notepad.exe - Loads dropped DLL 4 IoCs
pid Process 1880 notepad.exe 1880 notepad.exe 1888 jkfljdgsglhd.exe 1888 jkfljdgsglhd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1888 set thread context of 1372 1888 jkfljdgsglhd.exe 27 - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\appdata\jkfljdgsglhd.exe:ZoneIdentifier notepad.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1372 jkfljdgsglhd.exe - Suspicious behavior: EnumeratesProcesses 737 IoCs
pid Process 1156 a29eef18539cc9cf7ef1f3e57ee96979.exe 1888 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1372 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1372 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe 1972 jkfljdgsglhd.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1888 jkfljdgsglhd.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1372 jkfljdgsglhd.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1372 jkfljdgsglhd.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1156 wrote to memory of 1880 1156 a29eef18539cc9cf7ef1f3e57ee96979.exe 25 PID 1156 wrote to memory of 1880 1156 a29eef18539cc9cf7ef1f3e57ee96979.exe 25 PID 1156 wrote to memory of 1880 1156 a29eef18539cc9cf7ef1f3e57ee96979.exe 25 PID 1156 wrote to memory of 1880 1156 a29eef18539cc9cf7ef1f3e57ee96979.exe 25 PID 1156 wrote to memory of 1880 1156 a29eef18539cc9cf7ef1f3e57ee96979.exe 25 PID 1156 wrote to memory of 1880 1156 a29eef18539cc9cf7ef1f3e57ee96979.exe 25 PID 1880 wrote to memory of 1888 1880 notepad.exe 26 PID 1880 wrote to memory of 1888 1880 notepad.exe 26 PID 1880 wrote to memory of 1888 1880 notepad.exe 26 PID 1880 wrote to memory of 1888 1880 notepad.exe 26 PID 1888 wrote to memory of 1372 1888 jkfljdgsglhd.exe 27 PID 1888 wrote to memory of 1372 1888 jkfljdgsglhd.exe 27 PID 1888 wrote to memory of 1372 1888 jkfljdgsglhd.exe 27 PID 1888 wrote to memory of 1372 1888 jkfljdgsglhd.exe 27 PID 1888 wrote to memory of 1972 1888 jkfljdgsglhd.exe 28 PID 1888 wrote to memory of 1972 1888 jkfljdgsglhd.exe 28 PID 1888 wrote to memory of 1972 1888 jkfljdgsglhd.exe 28 PID 1888 wrote to memory of 1972 1888 jkfljdgsglhd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a29eef18539cc9cf7ef1f3e57ee96979.exe"C:\Users\Admin\AppData\Local\Temp\a29eef18539cc9cf7ef1f3e57ee96979.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Roaming\appdata\jkfljdgsglhd.exe"C:\Users\Admin\AppData\Roaming\appdata\jkfljdgsglhd.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Roaming\appdata\jkfljdgsglhd.exe"C:\Users\Admin\AppData\Roaming\appdata\jkfljdgsglhd.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1372
-
-
C:\Users\Admin\AppData\Roaming\appdata\jkfljdgsglhd.exe"C:\Users\Admin\AppData\Roaming\appdata\jkfljdgsglhd.exe" 2 1372 2592678744⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1972
-
-
-