8a4e005808be8cb30ec3e12b0e4ccc62cc579a2860268c40ec1f28fb3b278da0

Analysis

max time kernel
5s
max time network
114s
platform
windows10_x64
resource
win10
submitted
09/10/2020, 09:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Eurobank Transaction.exe
Size 1.2MB
Sample201009-sl3ymacqf6
SHA256 8a4e005808be8cb30ec3e12b0e4ccc62cc579a2860268c40ec1f28fb3b278da0
MD5 2164c53cf908355d1d3c17c7ed3e7bba
SHA1 a8e3796ff58dd229bc42d973f60099795f462689
SHA512 8ef4f2431747d4dd163dcfffc70a0e8c044fec7e93785a406678f257a6e97bb5187f9b3974eb14758af07ddbf867c06897b35ee2e9d0e8bccbb503ee0c24fa74
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AtBroker.url	Eurobank Transaction.exe

Suspicious behavior: MapViewOfSection 100 IoCs

pid	Process
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe
3076	Eurobank Transaction.exe

Suspicious use of WriteProcessMemory 300 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 68	3076	Eurobank Transaction.exe	73
PID 3076 wrote to memory of 68	3076	Eurobank Transaction.exe	73
PID 3076 wrote to memory of 68	3076	Eurobank Transaction.exe	73
PID 3076 wrote to memory of 344	3076	Eurobank Transaction.exe	74
PID 3076 wrote to memory of 344	3076	Eurobank Transaction.exe	74
PID 3076 wrote to memory of 344	3076	Eurobank Transaction.exe	74
PID 3076 wrote to memory of 1204	3076	Eurobank Transaction.exe	75
PID 3076 wrote to memory of 1204	3076	Eurobank Transaction.exe	75
PID 3076 wrote to memory of 1204	3076	Eurobank Transaction.exe	75
PID 3076 wrote to memory of 1228	3076	Eurobank Transaction.exe	76
PID 3076 wrote to memory of 1228	3076	Eurobank Transaction.exe	76
PID 3076 wrote to memory of 1228	3076	Eurobank Transaction.exe	76
PID 3076 wrote to memory of 1268	3076	Eurobank Transaction.exe	77
PID 3076 wrote to memory of 1268	3076	Eurobank Transaction.exe	77
PID 3076 wrote to memory of 1268	3076	Eurobank Transaction.exe	77
PID 3076 wrote to memory of 1360	3076	Eurobank Transaction.exe	78
PID 3076 wrote to memory of 1360	3076	Eurobank Transaction.exe	78
PID 3076 wrote to memory of 1360	3076	Eurobank Transaction.exe	78
PID 3076 wrote to memory of 1440	3076	Eurobank Transaction.exe	79
PID 3076 wrote to memory of 1440	3076	Eurobank Transaction.exe	79
PID 3076 wrote to memory of 1440	3076	Eurobank Transaction.exe	79
PID 3076 wrote to memory of 1488	3076	Eurobank Transaction.exe	80
PID 3076 wrote to memory of 1488	3076	Eurobank Transaction.exe	80
PID 3076 wrote to memory of 1488	3076	Eurobank Transaction.exe	80
PID 3076 wrote to memory of 1020	3076	Eurobank Transaction.exe	81
PID 3076 wrote to memory of 1020	3076	Eurobank Transaction.exe	81
PID 3076 wrote to memory of 1020	3076	Eurobank Transaction.exe	81
PID 3076 wrote to memory of 1616	3076	Eurobank Transaction.exe	82
PID 3076 wrote to memory of 1616	3076	Eurobank Transaction.exe	82
PID 3076 wrote to memory of 1616	3076	Eurobank Transaction.exe	82
PID 3076 wrote to memory of 1652	3076	Eurobank Transaction.exe	83
PID 3076 wrote to memory of 1652	3076	Eurobank Transaction.exe	83
PID 3076 wrote to memory of 1652	3076	Eurobank Transaction.exe	83
PID 3076 wrote to memory of 1784	3076	Eurobank Transaction.exe	84
PID 3076 wrote to memory of 1784	3076	Eurobank Transaction.exe	84
PID 3076 wrote to memory of 1784	3076	Eurobank Transaction.exe	84
PID 3076 wrote to memory of 1816	3076	Eurobank Transaction.exe	85
PID 3076 wrote to memory of 1816	3076	Eurobank Transaction.exe	85
PID 3076 wrote to memory of 1816	3076	Eurobank Transaction.exe	85
PID 3076 wrote to memory of 1844	3076	Eurobank Transaction.exe	86
PID 3076 wrote to memory of 1844	3076	Eurobank Transaction.exe	86
PID 3076 wrote to memory of 1844	3076	Eurobank Transaction.exe	86
PID 3076 wrote to memory of 2512	3076	Eurobank Transaction.exe	87
PID 3076 wrote to memory of 2512	3076	Eurobank Transaction.exe	87
PID 3076 wrote to memory of 2512	3076	Eurobank Transaction.exe	87
PID 3076 wrote to memory of 2276	3076	Eurobank Transaction.exe	88
PID 3076 wrote to memory of 2276	3076	Eurobank Transaction.exe	88
PID 3076 wrote to memory of 2276	3076	Eurobank Transaction.exe	88
PID 3076 wrote to memory of 3692	3076	Eurobank Transaction.exe	89
PID 3076 wrote to memory of 3692	3076	Eurobank Transaction.exe	89
PID 3076 wrote to memory of 3692	3076	Eurobank Transaction.exe	89
PID 3076 wrote to memory of 1848	3076	Eurobank Transaction.exe	90
PID 3076 wrote to memory of 1848	3076	Eurobank Transaction.exe	90
PID 3076 wrote to memory of 1848	3076	Eurobank Transaction.exe	90
PID 3076 wrote to memory of 1900	3076	Eurobank Transaction.exe	91
PID 3076 wrote to memory of 1900	3076	Eurobank Transaction.exe	91
PID 3076 wrote to memory of 1900	3076	Eurobank Transaction.exe	91
PID 3076 wrote to memory of 1980	3076	Eurobank Transaction.exe	92
PID 3076 wrote to memory of 1980	3076	Eurobank Transaction.exe	92
PID 3076 wrote to memory of 1980	3076	Eurobank Transaction.exe	92
PID 3076 wrote to memory of 3964	3076	Eurobank Transaction.exe	93
PID 3076 wrote to memory of 3964	3076	Eurobank Transaction.exe	93
PID 3076 wrote to memory of 3964	3076	Eurobank Transaction.exe	93
PID 3076 wrote to memory of 2068	3076	Eurobank Transaction.exe	94
PID 3076 wrote to memory of 2068	3076	Eurobank Transaction.exe	94
PID 3076 wrote to memory of 2068	3076	Eurobank Transaction.exe	94
PID 3076 wrote to memory of 1732	3076	Eurobank Transaction.exe	95
PID 3076 wrote to memory of 1732	3076	Eurobank Transaction.exe	95
PID 3076 wrote to memory of 1732	3076	Eurobank Transaction.exe	95
PID 3076 wrote to memory of 2060	3076	Eurobank Transaction.exe	96
PID 3076 wrote to memory of 2060	3076	Eurobank Transaction.exe	96
PID 3076 wrote to memory of 2060	3076	Eurobank Transaction.exe	96
PID 3076 wrote to memory of 2148	3076	Eurobank Transaction.exe	97
PID 3076 wrote to memory of 2148	3076	Eurobank Transaction.exe	97
PID 3076 wrote to memory of 2148	3076	Eurobank Transaction.exe	97
PID 3076 wrote to memory of 2164	3076	Eurobank Transaction.exe	98
PID 3076 wrote to memory of 2164	3076	Eurobank Transaction.exe	98
PID 3076 wrote to memory of 2164	3076	Eurobank Transaction.exe	98
PID 3076 wrote to memory of 2184	3076	Eurobank Transaction.exe	99
PID 3076 wrote to memory of 2184	3076	Eurobank Transaction.exe	99
PID 3076 wrote to memory of 2184	3076	Eurobank Transaction.exe	99
PID 3076 wrote to memory of 216	3076	Eurobank Transaction.exe	100
PID 3076 wrote to memory of 216	3076	Eurobank Transaction.exe	100
PID 3076 wrote to memory of 216	3076	Eurobank Transaction.exe	100
PID 3076 wrote to memory of 192	3076	Eurobank Transaction.exe	101
PID 3076 wrote to memory of 192	3076	Eurobank Transaction.exe	101
PID 3076 wrote to memory of 192	3076	Eurobank Transaction.exe	101
PID 3076 wrote to memory of 212	3076	Eurobank Transaction.exe	102
PID 3076 wrote to memory of 212	3076	Eurobank Transaction.exe	102
PID 3076 wrote to memory of 212	3076	Eurobank Transaction.exe	102
PID 3076 wrote to memory of 3008	3076	Eurobank Transaction.exe	103
PID 3076 wrote to memory of 3008	3076	Eurobank Transaction.exe	103
PID 3076 wrote to memory of 3008	3076	Eurobank Transaction.exe	103
PID 3076 wrote to memory of 3380	3076	Eurobank Transaction.exe	104
PID 3076 wrote to memory of 3380	3076	Eurobank Transaction.exe	104
PID 3076 wrote to memory of 3380	3076	Eurobank Transaction.exe	104
PID 3076 wrote to memory of 3440	3076	Eurobank Transaction.exe	105
PID 3076 wrote to memory of 3440	3076	Eurobank Transaction.exe	105
PID 3076 wrote to memory of 3440	3076	Eurobank Transaction.exe	105
PID 3076 wrote to memory of 1388	3076	Eurobank Transaction.exe	106
PID 3076 wrote to memory of 1388	3076	Eurobank Transaction.exe	106
PID 3076 wrote to memory of 1388	3076	Eurobank Transaction.exe	106
PID 3076 wrote to memory of 2488	3076	Eurobank Transaction.exe	107
PID 3076 wrote to memory of 2488	3076	Eurobank Transaction.exe	107
PID 3076 wrote to memory of 2488	3076	Eurobank Transaction.exe	107
PID 3076 wrote to memory of 2728	3076	Eurobank Transaction.exe	108
PID 3076 wrote to memory of 2728	3076	Eurobank Transaction.exe	108
PID 3076 wrote to memory of 2728	3076	Eurobank Transaction.exe	108
PID 3076 wrote to memory of 2824	3076	Eurobank Transaction.exe	109
PID 3076 wrote to memory of 2824	3076	Eurobank Transaction.exe	109
PID 3076 wrote to memory of 2824	3076	Eurobank Transaction.exe	109
PID 3076 wrote to memory of 2896	3076	Eurobank Transaction.exe	110
PID 3076 wrote to memory of 2896	3076	Eurobank Transaction.exe	110
PID 3076 wrote to memory of 2896	3076	Eurobank Transaction.exe	110
PID 3076 wrote to memory of 2932	3076	Eurobank Transaction.exe	111
PID 3076 wrote to memory of 2932	3076	Eurobank Transaction.exe	111
PID 3076 wrote to memory of 2932	3076	Eurobank Transaction.exe	111
PID 3076 wrote to memory of 3604	3076	Eurobank Transaction.exe	112
PID 3076 wrote to memory of 3604	3076	Eurobank Transaction.exe	112
PID 3076 wrote to memory of 3604	3076	Eurobank Transaction.exe	112
PID 3076 wrote to memory of 3708	3076	Eurobank Transaction.exe	113
PID 3076 wrote to memory of 3708	3076	Eurobank Transaction.exe	113
PID 3076 wrote to memory of 3708	3076	Eurobank Transaction.exe	113
PID 3076 wrote to memory of 3116	3076	Eurobank Transaction.exe	114
PID 3076 wrote to memory of 3116	3076	Eurobank Transaction.exe	114
PID 3076 wrote to memory of 3116	3076	Eurobank Transaction.exe	114
PID 3076 wrote to memory of 3960	3076	Eurobank Transaction.exe	115
PID 3076 wrote to memory of 3960	3076	Eurobank Transaction.exe	115
PID 3076 wrote to memory of 3960	3076	Eurobank Transaction.exe	115
PID 3076 wrote to memory of 4052	3076	Eurobank Transaction.exe	116
PID 3076 wrote to memory of 4052	3076	Eurobank Transaction.exe	116
PID 3076 wrote to memory of 4052	3076	Eurobank Transaction.exe	116
PID 3076 wrote to memory of 3596	3076	Eurobank Transaction.exe	117
PID 3076 wrote to memory of 3596	3076	Eurobank Transaction.exe	117
PID 3076 wrote to memory of 3596	3076	Eurobank Transaction.exe	117
PID 3076 wrote to memory of 3984	3076	Eurobank Transaction.exe	118
PID 3076 wrote to memory of 3984	3076	Eurobank Transaction.exe	118
PID 3076 wrote to memory of 3984	3076	Eurobank Transaction.exe	118
PID 3076 wrote to memory of 3968	3076	Eurobank Transaction.exe	119
PID 3076 wrote to memory of 3968	3076	Eurobank Transaction.exe	119
PID 3076 wrote to memory of 3968	3076	Eurobank Transaction.exe	119
PID 3076 wrote to memory of 1408	3076	Eurobank Transaction.exe	120
PID 3076 wrote to memory of 1408	3076	Eurobank Transaction.exe	120
PID 3076 wrote to memory of 1408	3076	Eurobank Transaction.exe	120
PID 3076 wrote to memory of 1384	3076	Eurobank Transaction.exe	121
PID 3076 wrote to memory of 1384	3076	Eurobank Transaction.exe	121
PID 3076 wrote to memory of 1384	3076	Eurobank Transaction.exe	121
PID 3076 wrote to memory of 2212	3076	Eurobank Transaction.exe	122
PID 3076 wrote to memory of 2212	3076	Eurobank Transaction.exe	122
PID 3076 wrote to memory of 2212	3076	Eurobank Transaction.exe	122
PID 3076 wrote to memory of 720	3076	Eurobank Transaction.exe	123
PID 3076 wrote to memory of 720	3076	Eurobank Transaction.exe	123
PID 3076 wrote to memory of 720	3076	Eurobank Transaction.exe	123
PID 3076 wrote to memory of 2208	3076	Eurobank Transaction.exe	124
PID 3076 wrote to memory of 2208	3076	Eurobank Transaction.exe	124
PID 3076 wrote to memory of 2208	3076	Eurobank Transaction.exe	124
PID 3076 wrote to memory of 3928	3076	Eurobank Transaction.exe	125
PID 3076 wrote to memory of 3928	3076	Eurobank Transaction.exe	125
PID 3076 wrote to memory of 3928	3076	Eurobank Transaction.exe	125
PID 3076 wrote to memory of 3868	3076	Eurobank Transaction.exe	126
PID 3076 wrote to memory of 3868	3076	Eurobank Transaction.exe	126
PID 3076 wrote to memory of 3868	3076	Eurobank Transaction.exe	126
PID 3076 wrote to memory of 1856	3076	Eurobank Transaction.exe	127
PID 3076 wrote to memory of 1856	3076	Eurobank Transaction.exe	127
PID 3076 wrote to memory of 1856	3076	Eurobank Transaction.exe	127
PID 3076 wrote to memory of 3704	3076	Eurobank Transaction.exe	128
PID 3076 wrote to memory of 3704	3076	Eurobank Transaction.exe	128
PID 3076 wrote to memory of 3704	3076	Eurobank Transaction.exe	128
PID 3076 wrote to memory of 3052	3076	Eurobank Transaction.exe	129
PID 3076 wrote to memory of 3052	3076	Eurobank Transaction.exe	129
PID 3076 wrote to memory of 3052	3076	Eurobank Transaction.exe	129
PID 3076 wrote to memory of 1100	3076	Eurobank Transaction.exe	130
PID 3076 wrote to memory of 1100	3076	Eurobank Transaction.exe	130
PID 3076 wrote to memory of 1100	3076	Eurobank Transaction.exe	130
PID 3076 wrote to memory of 1224	3076	Eurobank Transaction.exe	131
PID 3076 wrote to memory of 1224	3076	Eurobank Transaction.exe	131
PID 3076 wrote to memory of 1224	3076	Eurobank Transaction.exe	131
PID 3076 wrote to memory of 1504	3076	Eurobank Transaction.exe	132
PID 3076 wrote to memory of 1504	3076	Eurobank Transaction.exe	132
PID 3076 wrote to memory of 1504	3076	Eurobank Transaction.exe	132
PID 3076 wrote to memory of 1632	3076	Eurobank Transaction.exe	133
PID 3076 wrote to memory of 1632	3076	Eurobank Transaction.exe	133
PID 3076 wrote to memory of 1632	3076	Eurobank Transaction.exe	133
PID 3076 wrote to memory of 1840	3076	Eurobank Transaction.exe	134
PID 3076 wrote to memory of 1840	3076	Eurobank Transaction.exe	134
PID 3076 wrote to memory of 1840	3076	Eurobank Transaction.exe	134
PID 3076 wrote to memory of 3664	3076	Eurobank Transaction.exe	135
PID 3076 wrote to memory of 3664	3076	Eurobank Transaction.exe	135
PID 3076 wrote to memory of 3664	3076	Eurobank Transaction.exe	135
PID 3076 wrote to memory of 1972	3076	Eurobank Transaction.exe	136
PID 3076 wrote to memory of 1972	3076	Eurobank Transaction.exe	136
PID 3076 wrote to memory of 1972	3076	Eurobank Transaction.exe	136
PID 3076 wrote to memory of 1060	3076	Eurobank Transaction.exe	137
PID 3076 wrote to memory of 1060	3076	Eurobank Transaction.exe	137
PID 3076 wrote to memory of 1060	3076	Eurobank Transaction.exe	137
PID 3076 wrote to memory of 2176	3076	Eurobank Transaction.exe	138
PID 3076 wrote to memory of 2176	3076	Eurobank Transaction.exe	138
PID 3076 wrote to memory of 2176	3076	Eurobank Transaction.exe	138
PID 3076 wrote to memory of 196	3076	Eurobank Transaction.exe	139
PID 3076 wrote to memory of 196	3076	Eurobank Transaction.exe	139
PID 3076 wrote to memory of 196	3076	Eurobank Transaction.exe	139
PID 3076 wrote to memory of 3368	3076	Eurobank Transaction.exe	140
PID 3076 wrote to memory of 3368	3076	Eurobank Transaction.exe	140
PID 3076 wrote to memory of 3368	3076	Eurobank Transaction.exe	140
PID 3076 wrote to memory of 2456	3076	Eurobank Transaction.exe	141
PID 3076 wrote to memory of 2456	3076	Eurobank Transaction.exe	141
PID 3076 wrote to memory of 2456	3076	Eurobank Transaction.exe	141
PID 3076 wrote to memory of 2844	3076	Eurobank Transaction.exe	142
PID 3076 wrote to memory of 2844	3076	Eurobank Transaction.exe	142
PID 3076 wrote to memory of 2844	3076	Eurobank Transaction.exe	142
PID 3076 wrote to memory of 4080	3076	Eurobank Transaction.exe	143
PID 3076 wrote to memory of 4080	3076	Eurobank Transaction.exe	143
PID 3076 wrote to memory of 4080	3076	Eurobank Transaction.exe	143
PID 3076 wrote to memory of 3512	3076	Eurobank Transaction.exe	144
PID 3076 wrote to memory of 3512	3076	Eurobank Transaction.exe	144
PID 3076 wrote to memory of 3512	3076	Eurobank Transaction.exe	144
PID 3076 wrote to memory of 3736	3076	Eurobank Transaction.exe	145
PID 3076 wrote to memory of 3736	3076	Eurobank Transaction.exe	145
PID 3076 wrote to memory of 3736	3076	Eurobank Transaction.exe	145
PID 3076 wrote to memory of 1660	3076	Eurobank Transaction.exe	146
PID 3076 wrote to memory of 1660	3076	Eurobank Transaction.exe	146
PID 3076 wrote to memory of 1660	3076	Eurobank Transaction.exe	146
PID 3076 wrote to memory of 3800	3076	Eurobank Transaction.exe	147
PID 3076 wrote to memory of 3800	3076	Eurobank Transaction.exe	147
PID 3076 wrote to memory of 3800	3076	Eurobank Transaction.exe	147
PID 3076 wrote to memory of 3712	3076	Eurobank Transaction.exe	148
PID 3076 wrote to memory of 3712	3076	Eurobank Transaction.exe	148
PID 3076 wrote to memory of 3712	3076	Eurobank Transaction.exe	148
PID 3076 wrote to memory of 1212	3076	Eurobank Transaction.exe	149
PID 3076 wrote to memory of 1212	3076	Eurobank Transaction.exe	149
PID 3076 wrote to memory of 1212	3076	Eurobank Transaction.exe	149
PID 3076 wrote to memory of 1780	3076	Eurobank Transaction.exe	150
PID 3076 wrote to memory of 1780	3076	Eurobank Transaction.exe	150
PID 3076 wrote to memory of 1780	3076	Eurobank Transaction.exe	150
PID 3076 wrote to memory of 2132	3076	Eurobank Transaction.exe	151
PID 3076 wrote to memory of 2132	3076	Eurobank Transaction.exe	151
PID 3076 wrote to memory of 2132	3076	Eurobank Transaction.exe	151
PID 3076 wrote to memory of 3012	3076	Eurobank Transaction.exe	152
PID 3076 wrote to memory of 3012	3076	Eurobank Transaction.exe	152
PID 3076 wrote to memory of 3012	3076	Eurobank Transaction.exe	152
PID 3076 wrote to memory of 3448	3076	Eurobank Transaction.exe	153
PID 3076 wrote to memory of 3448	3076	Eurobank Transaction.exe	153
PID 3076 wrote to memory of 3448	3076	Eurobank Transaction.exe	153
PID 3076 wrote to memory of 1400	3076	Eurobank Transaction.exe	154
PID 3076 wrote to memory of 1400	3076	Eurobank Transaction.exe	154
PID 3076 wrote to memory of 1400	3076	Eurobank Transaction.exe	154
PID 3076 wrote to memory of 3180	3076	Eurobank Transaction.exe	155
PID 3076 wrote to memory of 3180	3076	Eurobank Transaction.exe	155
PID 3076 wrote to memory of 3180	3076	Eurobank Transaction.exe	155
PID 3076 wrote to memory of 3040	3076	Eurobank Transaction.exe	156
PID 3076 wrote to memory of 3040	3076	Eurobank Transaction.exe	156
PID 3076 wrote to memory of 3040	3076	Eurobank Transaction.exe	156
PID 3076 wrote to memory of 3564	3076	Eurobank Transaction.exe	157
PID 3076 wrote to memory of 3564	3076	Eurobank Transaction.exe	157
PID 3076 wrote to memory of 3564	3076	Eurobank Transaction.exe	157
PID 3076 wrote to memory of 3532	3076	Eurobank Transaction.exe	158
PID 3076 wrote to memory of 3532	3076	Eurobank Transaction.exe	158
PID 3076 wrote to memory of 3532	3076	Eurobank Transaction.exe	158
PID 3076 wrote to memory of 4108	3076	Eurobank Transaction.exe	159
PID 3076 wrote to memory of 4108	3076	Eurobank Transaction.exe	159
PID 3076 wrote to memory of 4108	3076	Eurobank Transaction.exe	159
PID 3076 wrote to memory of 4120	3076	Eurobank Transaction.exe	160
PID 3076 wrote to memory of 4120	3076	Eurobank Transaction.exe	160
PID 3076 wrote to memory of 4120	3076	Eurobank Transaction.exe	160
PID 3076 wrote to memory of 4132	3076	Eurobank Transaction.exe	161
PID 3076 wrote to memory of 4132	3076	Eurobank Transaction.exe	161
PID 3076 wrote to memory of 4132	3076	Eurobank Transaction.exe	161
PID 3076 wrote to memory of 4144	3076	Eurobank Transaction.exe	162
PID 3076 wrote to memory of 4144	3076	Eurobank Transaction.exe	162
PID 3076 wrote to memory of 4144	3076	Eurobank Transaction.exe	162
PID 3076 wrote to memory of 4156	3076	Eurobank Transaction.exe	163
PID 3076 wrote to memory of 4156	3076	Eurobank Transaction.exe	163
PID 3076 wrote to memory of 4156	3076	Eurobank Transaction.exe	163
PID 3076 wrote to memory of 4168	3076	Eurobank Transaction.exe	164
PID 3076 wrote to memory of 4168	3076	Eurobank Transaction.exe	164
PID 3076 wrote to memory of 4168	3076	Eurobank Transaction.exe	164
PID 3076 wrote to memory of 4180	3076	Eurobank Transaction.exe	165
PID 3076 wrote to memory of 4180	3076	Eurobank Transaction.exe	165
PID 3076 wrote to memory of 4180	3076	Eurobank Transaction.exe	165
PID 3076 wrote to memory of 4192	3076	Eurobank Transaction.exe	166
PID 3076 wrote to memory of 4192	3076	Eurobank Transaction.exe	166
PID 3076 wrote to memory of 4192	3076	Eurobank Transaction.exe	166
PID 3076 wrote to memory of 4204	3076	Eurobank Transaction.exe	167
PID 3076 wrote to memory of 4204	3076	Eurobank Transaction.exe	167
PID 3076 wrote to memory of 4204	3076	Eurobank Transaction.exe	167
PID 3076 wrote to memory of 4216	3076	Eurobank Transaction.exe	168
PID 3076 wrote to memory of 4216	3076	Eurobank Transaction.exe	168
PID 3076 wrote to memory of 4216	3076	Eurobank Transaction.exe	168
PID 3076 wrote to memory of 4228	3076	Eurobank Transaction.exe	169
PID 3076 wrote to memory of 4228	3076	Eurobank Transaction.exe	169
PID 3076 wrote to memory of 4228	3076	Eurobank Transaction.exe	169
PID 3076 wrote to memory of 4240	3076	Eurobank Transaction.exe	170
PID 3076 wrote to memory of 4240	3076	Eurobank Transaction.exe	170
PID 3076 wrote to memory of 4240	3076	Eurobank Transaction.exe	170
PID 3076 wrote to memory of 4252	3076	Eurobank Transaction.exe	171
PID 3076 wrote to memory of 4252	3076	Eurobank Transaction.exe	171
PID 3076 wrote to memory of 4252	3076	Eurobank Transaction.exe	171
PID 3076 wrote to memory of 4264	3076	Eurobank Transaction.exe	172
PID 3076 wrote to memory of 4264	3076	Eurobank Transaction.exe	172
PID 3076 wrote to memory of 4264	3076	Eurobank Transaction.exe	172

C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
"C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
1⤵
- Drops startup file
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:68
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:344
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1268
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1360
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1440
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1488
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1020
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1616
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1784
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2276
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3692
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1848
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3964
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2068
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2148
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2164
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2184
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:216
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:192
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:212
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3440
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1388
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2488
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2824
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3604
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3708
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3116
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3960
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3596
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3984
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3968
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1408
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2212
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:720
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3928
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3868
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1856
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3704
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1100
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1224
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1504
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1840
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3664
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1060
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2176
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:196
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2456
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2844
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4080
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3736
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3712
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1212
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1780
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:1400
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3180
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3564
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:3532
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4120
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4144
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4156
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4168
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4192
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4204
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4216
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4228
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4240
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe
  "C:\Users\Admin\AppData\Local\Temp\Eurobank Transaction.exe"
  2⤵
  PID:4264

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads