Analysis
- max time kernel
151s - max time network
149s - platform
windows7_x64 - resource
win7 - submitted
05/09/2020, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe
- Size 164KB
- Sample200905-xpv4ezpd62
- SHA256 11065b412136c549ee8944ee85eddaee903039fd5f09e502caf5ab50234fc2fd
- MD5 af2c8b85835314fcfcda1e166aea9153
- SHA1 9543f59b19dee0c0db8b445c258c97b43ae27be6
- SHA512 8a50b3996448d1666983824da4da624bd895056aceb9356c362156be3997a10db3b50ac5e3dd7b09ef286ad4c149b40576e098a27128bf9daa919085ddd91c93
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://89.203.250.175/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 1896 416.exe - Deletes itself 1 IoCs
pid Process 1264 Process not Found - Loads dropped DLL 1 IoCs
pid Process 1296 SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe - Suspicious behavior: EnumeratesProcesses 757 IoCs
pid Process 1296 SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe 1296 SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1116 explorer.exe 1264 Process not Found 1116 explorer.exe 1116 explorer.exe 1116 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1960 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1960 explorer.exe 1364 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1960 explorer.exe 1648 explorer.exe 1364 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1364 explorer.exe 1960 explorer.exe 1648 explorer.exe 1412 explorer.exe 1364 explorer.exe 1960 explorer.exe 1648 explorer.exe 1848 explorer.exe 1364 explorer.exe 1960 explorer.exe 1648 explorer.exe 1264 Process not Found 832 explorer.exe 1364 explorer.exe 1960 explorer.exe 1648 explorer.exe 1412 explorer.exe 1364 explorer.exe 1412 explorer.exe 1960 explorer.exe 1648 explorer.exe 1264 Process not Found 1364 explorer.exe 1412 explorer.exe 1960 explorer.exe 1648 explorer.exe 1264 Process not Found 1264 Process not Found 832 explorer.exe 1364 explorer.exe 1264 Process not Found 1848 explorer.exe 1412 explorer.exe 1264 Process not Found 1960 explorer.exe 1648 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 832 explorer.exe 1364 explorer.exe 1848 explorer.exe 1264 Process not Found 1412 explorer.exe 1960 explorer.exe 1648 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1364 explorer.exe 832 explorer.exe 1264 Process not Found 1848 explorer.exe 1412 explorer.exe 1264 Process not Found 1648 explorer.exe 1960 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1364 explorer.exe 832 explorer.exe 1264 Process not Found 1848 explorer.exe 1412 explorer.exe 1960 explorer.exe 1648 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1364 explorer.exe 832 explorer.exe 1264 Process not Found 1848 explorer.exe 1412 explorer.exe 1264 Process not Found 1960 explorer.exe 1648 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1364 explorer.exe 1264 Process not Found 832 explorer.exe 1848 explorer.exe 1264 Process not Found 1412 explorer.exe 1960 explorer.exe 1648 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1364 explorer.exe 832 explorer.exe 1848 explorer.exe 1264 Process not Found 1412 explorer.exe 1960 explorer.exe 1264 Process not Found 1648 explorer.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 832 explorer.exe 1364 explorer.exe 1264 Process not Found - Suspicious behavior: MapViewOfSection 31 IoCs
pid Process 1296 SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found - Suspicious use of WriteProcessMemory 74 IoCs
description pid Process procid_target PID 1264 wrote to memory of 1896 1264 Process not Found 28 PID 1264 wrote to memory of 1896 1264 Process not Found 28 PID 1264 wrote to memory of 1896 1264 Process not Found 28 PID 1264 wrote to memory of 1896 1264 Process not Found 28 PID 1264 wrote to memory of 1912 1264 Process not Found 29 PID 1264 wrote to memory of 1912 1264 Process not Found 29 PID 1264 wrote to memory of 1912 1264 Process not Found 29 PID 1264 wrote to memory of 1912 1264 Process not Found 29 PID 1264 wrote to memory of 1912 1264 Process not Found 29 PID 1264 wrote to memory of 1116 1264 Process not Found 31 PID 1264 wrote to memory of 1116 1264 Process not Found 31 PID 1264 wrote to memory of 1116 1264 Process not Found 31 PID 1264 wrote to memory of 1116 1264 Process not Found 31 PID 1264 wrote to memory of 1828 1264 Process not Found 32 PID 1264 wrote to memory of 1828 1264 Process not Found 32 PID 1264 wrote to memory of 1828 1264 Process not Found 32 PID 1264 wrote to memory of 1828 1264 Process not Found 32 PID 1264 wrote to memory of 1828 1264 Process not Found 32 PID 1264 wrote to memory of 1116 1264 Process not Found 33 PID 1264 wrote to memory of 1116 1264 Process not Found 33 PID 1264 wrote to memory of 1116 1264 Process not Found 33 PID 1264 wrote to memory of 1116 1264 Process not Found 33 PID 1264 wrote to memory of 1116 1264 Process not Found 33 PID 1264 wrote to memory of 1960 1264 Process not Found 35 PID 1264 wrote to memory of 1960 1264 Process not Found 35 PID 1264 wrote to memory of 1960 1264 Process not Found 35 PID 1264 wrote to memory of 1960 1264 Process not Found 35 PID 1264 wrote to memory of 1960 1264 Process not Found 35 PID 1264 wrote to memory of 1364 1264 Process not Found 36 PID 1264 wrote to memory of 1364 1264 Process not Found 36 PID 1264 wrote to memory of 1364 1264 Process not Found 36 PID 1264 wrote to memory of 1364 1264 Process not Found 36 PID 1264 wrote to memory of 1648 1264 Process not Found 37 PID 1264 wrote to memory of 1648 1264 Process not Found 37 PID 1264 wrote to memory of 1648 1264 Process not Found 37 PID 1264 wrote to memory of 1648 1264 Process not Found 37 PID 1264 wrote to memory of 1648 1264 Process not Found 37 PID 1264 wrote to memory of 1412 1264 Process not Found 38 PID 1264 wrote to memory of 1412 1264 Process not Found 38 PID 1264 wrote to memory of 1412 1264 Process not Found 38 PID 1264 wrote to memory of 1412 1264 Process not Found 38 PID 1264 wrote to memory of 1848 1264 Process not Found 39 PID 1264 wrote to memory of 1848 1264 Process not Found 39 PID 1264 wrote to memory of 1848 1264 Process not Found 39 PID 1264 wrote to memory of 1848 1264 Process not Found 39 PID 1264 wrote to memory of 1848 1264 Process not Found 39 PID 1264 wrote to memory of 832 1264 Process not Found 40 PID 1264 wrote to memory of 832 1264 Process not Found 40 PID 1264 wrote to memory of 832 1264 Process not Found 40 PID 1264 wrote to memory of 832 1264 Process not Found 40 PID 1264 wrote to memory of 360 1264 Process not Found 41 PID 1264 wrote to memory of 360 1264 Process not Found 41 PID 1264 wrote to memory of 360 1264 Process not Found 41 PID 1264 wrote to memory of 360 1264 Process not Found 41 PID 1264 wrote to memory of 360 1264 Process not Found 41 PID 1264 wrote to memory of 1620 1264 Process not Found 42 PID 1264 wrote to memory of 1620 1264 Process not Found 42 PID 1264 wrote to memory of 1620 1264 Process not Found 42 PID 1264 wrote to memory of 1620 1264 Process not Found 42 PID 1264 wrote to memory of 1620 1264 Process not Found 42 PID 1264 wrote to memory of 1688 1264 Process not Found 43 PID 1264 wrote to memory of 1688 1264 Process not Found 43 PID 1264 wrote to memory of 1688 1264 Process not Found 43 PID 1264 wrote to memory of 1688 1264 Process not Found 43 PID 1264 wrote to memory of 1688 1264 Process not Found 43 PID 1264 wrote to memory of 1748 1264 Process not Found 44 PID 1264 wrote to memory of 1748 1264 Process not Found 44 PID 1264 wrote to memory of 1748 1264 Process not Found 44 PID 1264 wrote to memory of 1748 1264 Process not Found 44 PID 1264 wrote to memory of 1532 1264 Process not Found 45 PID 1264 wrote to memory of 1532 1264 Process not Found 45 PID 1264 wrote to memory of 1532 1264 Process not Found 45 PID 1264 wrote to memory of 1532 1264 Process not Found 45 PID 1264 wrote to memory of 1532 1264 Process not Found 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.34423471.22019.28366.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1296
-
C:\Users\Admin\AppData\Local\Temp\416.exeC:\Users\Admin\AppData\Local\Temp\416.exe1⤵
- Executes dropped EXE
PID:1896
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1912
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1116
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1828
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1116
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1960
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1364
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1648
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1412
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1848
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:832
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:360
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1620
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1688
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1748
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1532