Analysis
- max time kernel
151s - max time network
128s - platform
windows7_x64 - resource
win7 - submitted
09/09/2020, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
5d2216c22cbd6af8d98e633c6d27010a.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5d2216c22cbd6af8d98e633c6d27010a.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 5d2216c22cbd6af8d98e633c6d27010a.exe
- Size 1.0MB
- Sample200909-28nttemz42
- SHA256 3d5ccf2295d249dcdc8309b2471ba26943edd9945ececd27929335cccf65049b
- MD5 5d2216c22cbd6af8d98e633c6d27010a
- SHA1 2234d070a9eecaa4ce7f4ffd71d14e6ebbe16cd3
- SHA512 535db2937f66775d4cdd0eb27808454fb027d933444c51a0f39f5145fe99e9157ddafb1f075ffb12d8cd743731d2e0d5084573d377d3d18810f15e33df914cf4
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\E2C1E8F1FA\Log.txt
-
masslogger
Ransom Note
- <|| v2.1.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 9/9/2020 12:17:54 PM MassLogger Started: 9/9/2020 12:17:48 PM Interval: 1 hour MassLogger Process: C:\Users\Admin\AppData\Roaming\appdata\hasjkhka.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
yara_rule masslogger_log_file - Executes dropped EXE 3 IoCs
pid Process 1796 hasjkhka.exe 1180 hasjkhka.exe 1780 hasjkhka.exe -
resource yara_rule behavioral1/memory/1180-9-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1180-9-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1180-12-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1180-12-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1180-14-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1180-14-0x0000000000400000-0x0000000000541000-memory.dmp upx - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\International\Geo\Nation hasjkhka.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win .vbs notepad.exe - Loads dropped DLL 2 IoCs
pid Process 1048 notepad.exe 1048 notepad.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1796 set thread context of 1180 1796 hasjkhka.exe 28 - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\appdata\hasjkhka.exe:ZoneIdentifier notepad.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1180 hasjkhka.exe - Suspicious behavior: EnumeratesProcesses 768 IoCs
pid Process 336 5d2216c22cbd6af8d98e633c6d27010a.exe 1796 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1180 hasjkhka.exe 1180 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe 1780 hasjkhka.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1796 hasjkhka.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1180 hasjkhka.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1180 hasjkhka.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 336 wrote to memory of 1048 336 5d2216c22cbd6af8d98e633c6d27010a.exe 26 PID 336 wrote to memory of 1048 336 5d2216c22cbd6af8d98e633c6d27010a.exe 26 PID 336 wrote to memory of 1048 336 5d2216c22cbd6af8d98e633c6d27010a.exe 26 PID 336 wrote to memory of 1048 336 5d2216c22cbd6af8d98e633c6d27010a.exe 26 PID 336 wrote to memory of 1048 336 5d2216c22cbd6af8d98e633c6d27010a.exe 26 PID 336 wrote to memory of 1048 336 5d2216c22cbd6af8d98e633c6d27010a.exe 26 PID 1048 wrote to memory of 1796 1048 notepad.exe 27 PID 1048 wrote to memory of 1796 1048 notepad.exe 27 PID 1048 wrote to memory of 1796 1048 notepad.exe 27 PID 1048 wrote to memory of 1796 1048 notepad.exe 27 PID 1796 wrote to memory of 1180 1796 hasjkhka.exe 28 PID 1796 wrote to memory of 1180 1796 hasjkhka.exe 28 PID 1796 wrote to memory of 1180 1796 hasjkhka.exe 28 PID 1796 wrote to memory of 1180 1796 hasjkhka.exe 28 PID 1796 wrote to memory of 1780 1796 hasjkhka.exe 29 PID 1796 wrote to memory of 1780 1796 hasjkhka.exe 29 PID 1796 wrote to memory of 1780 1796 hasjkhka.exe 29 PID 1796 wrote to memory of 1780 1796 hasjkhka.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d2216c22cbd6af8d98e633c6d27010a.exe"C:\Users\Admin\AppData\Local\Temp\5d2216c22cbd6af8d98e633c6d27010a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Roaming\appdata\hasjkhka.exe"C:\Users\Admin\AppData\Roaming\appdata\hasjkhka.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Roaming\appdata\hasjkhka.exe"C:\Users\Admin\AppData\Roaming\appdata\hasjkhka.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1180
-
-
C:\Users\Admin\AppData\Roaming\appdata\hasjkhka.exe"C:\Users\Admin\AppData\Roaming\appdata\hasjkhka.exe" 2 1180 2592670314⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
-