Analysis
- max time kernel
152s - max time network
116s - platform
windows7_x64 - resource
win7v200722 - submitted
15/09/2020, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
ccb8b817085d6383614156053979e81b.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ccb8b817085d6383614156053979e81b.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target ccb8b817085d6383614156053979e81b.exe
- Size 989KB
- Sample200915-3qb2efcyc2
- SHA256 f55f1629d0ce8fefbc36ec5ec8f108485e494363531f372f4735186aa4c1bc85
- MD5 ccb8b817085d6383614156053979e81b
- SHA1 924db1dab545f9d08b47093d342d024217607d1c
- SHA512 df6bab868826f108712079b126382541f168d855e811860569099b3daf41a289472302016c61fdd40555d4472b4d75efa4667a44b00c97d5e1b77f04d415499e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\42EF15E83D\Log.txt
-
masslogger
Ransom Note
- <|| v2.1.0.0 ||> User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 9/15/2020 4:43:53 PM MassLogger Started: 9/15/2020 4:43:45 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Roaming\appdata\fkshsks.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
yara_rule masslogger_log_file - Executes dropped EXE 3 IoCs
pid Process 1668 fkshsks.exe 1768 fkshsks.exe 1836 fkshsks.exe -
resource yara_rule behavioral1/memory/1768-10-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1768-10-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1768-16-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1768-16-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1768-18-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1768-18-0x0000000000400000-0x0000000000541000-memory.dmp upx - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\International\Geo\Nation fkshsks.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs notepad.exe - Loads dropped DLL 4 IoCs
pid Process 1528 notepad.exe 1528 notepad.exe 1668 fkshsks.exe 1668 fkshsks.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1668 set thread context of 1768 1668 fkshsks.exe 27 - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\appdata\fkshsks.exe:ZoneIdentifier notepad.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1768 fkshsks.exe - Suspicious behavior: EnumeratesProcesses 731 IoCs
pid Process 1304 ccb8b817085d6383614156053979e81b.exe 1668 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1768 fkshsks.exe 1768 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe 1836 fkshsks.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1668 fkshsks.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1768 fkshsks.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1768 fkshsks.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1528 1304 ccb8b817085d6383614156053979e81b.exe 25 PID 1304 wrote to memory of 1528 1304 ccb8b817085d6383614156053979e81b.exe 25 PID 1304 wrote to memory of 1528 1304 ccb8b817085d6383614156053979e81b.exe 25 PID 1304 wrote to memory of 1528 1304 ccb8b817085d6383614156053979e81b.exe 25 PID 1304 wrote to memory of 1528 1304 ccb8b817085d6383614156053979e81b.exe 25 PID 1304 wrote to memory of 1528 1304 ccb8b817085d6383614156053979e81b.exe 25 PID 1528 wrote to memory of 1668 1528 notepad.exe 26 PID 1528 wrote to memory of 1668 1528 notepad.exe 26 PID 1528 wrote to memory of 1668 1528 notepad.exe 26 PID 1528 wrote to memory of 1668 1528 notepad.exe 26 PID 1668 wrote to memory of 1768 1668 fkshsks.exe 27 PID 1668 wrote to memory of 1768 1668 fkshsks.exe 27 PID 1668 wrote to memory of 1768 1668 fkshsks.exe 27 PID 1668 wrote to memory of 1768 1668 fkshsks.exe 27 PID 1668 wrote to memory of 1836 1668 fkshsks.exe 28 PID 1668 wrote to memory of 1836 1668 fkshsks.exe 28 PID 1668 wrote to memory of 1836 1668 fkshsks.exe 28 PID 1668 wrote to memory of 1836 1668 fkshsks.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccb8b817085d6383614156053979e81b.exe"C:\Users\Admin\AppData\Local\Temp\ccb8b817085d6383614156053979e81b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Roaming\appdata\fkshsks.exe"C:\Users\Admin\AppData\Roaming\appdata\fkshsks.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Roaming\appdata\fkshsks.exe"C:\Users\Admin\AppData\Roaming\appdata\fkshsks.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
C:\Users\Admin\AppData\Roaming\appdata\fkshsks.exe"C:\Users\Admin\AppData\Roaming\appdata\fkshsks.exe" 2 1768 2593094794⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1836
-
-
-