Analysis
- max time kernel
153s - max time network
158s - platform
windows10_x64 - resource
win10v20201028 - submitted
06/11/2020, 10:37
Static task
static1
Behavioral task
behavioral1
Sample
ForQuotation_RMS22100.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ForQuotation_RMS22100.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target ForQuotation_RMS22100.exe
- Size 582KB
- Sample201106-x31emsgr82
- SHA256 c35d8629ac725a6fd6bc953e5f86e4fa1b8a3680b367b52b33880ddeaa7492d4
- MD5 0e20f919b03845002c839824f0665b19
- SHA1 e058a00e2027612bc4f4fb35e90bd7bdc3009aa3
- SHA512 65d074b4f1b246c58bd9b48f3f004d4b56d1efba06401fa9b52afedd1adaaee981e08eed61f91ebd1d2f266d50676c7c039d53743fd46824d84cc641f60db9e3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- NetWire RAT payload 3 IoCs
resource yara_rule behavioral2/memory/2080-42-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2080-43-0x000000000040242D-mapping.dmp netwire behavioral2/memory/2080-45-0x0000000000400000-0x0000000000433000-memory.dmp netwire - Executes dropped EXE 2 IoCs
pid Process 3716 Uysppahmnmoq.exe 2080 Uysppahmnmoq.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\"" Uysppahmnmoq.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3716 set thread context of 2080 3716 Uysppahmnmoq.exe 87 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings ForQuotation_RMS22100.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3716 Uysppahmnmoq.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2828 AcroRd32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe 2828 AcroRd32.exe - Suspicious use of WriteProcessMemory 270 IoCs
description pid Process procid_target PID 648 wrote to memory of 3716 648 ForQuotation_RMS22100.exe 75 PID 648 wrote to memory of 3716 648 ForQuotation_RMS22100.exe 75 PID 648 wrote to memory of 3716 648 ForQuotation_RMS22100.exe 75 PID 648 wrote to memory of 2828 648 ForQuotation_RMS22100.exe 76 PID 648 wrote to memory of 2828 648 ForQuotation_RMS22100.exe 76 PID 648 wrote to memory of 2828 648 ForQuotation_RMS22100.exe 76 PID 2828 wrote to memory of 3560 2828 AcroRd32.exe 79 PID 2828 wrote to memory of 3560 2828 AcroRd32.exe 79 PID 2828 wrote to memory of 3560 2828 AcroRd32.exe 79 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 1480 3560 RdrCEF.exe 80 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2004 3560 RdrCEF.exe 81 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 2072 3560 RdrCEF.exe 82 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 4072 3560 RdrCEF.exe 83 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 3084 3560 RdrCEF.exe 84 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3560 wrote to memory of 2792 3560 RdrCEF.exe 85 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87 PID 3716 wrote to memory of 2080 3716 Uysppahmnmoq.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\ForQuotation_RMS22100.exe"C:\Users\Admin\AppData\Local\Temp\ForQuotation_RMS22100.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\Uysppahmnmoq.exe"C:\Users\Admin\AppData\Local\Temp\Uysppahmnmoq.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\Uysppahmnmoq.exe"C:\Users\Admin\AppData\Local\Temp\Uysppahmnmoq.exe"3⤵
- Executes dropped EXE
PID:2080
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Zybhohryujlrnz.pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E84180771F4AB205833CD1D0DFACB6CD --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1480
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=785680D4ECF5FBDE00BE1104415AE3F3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=785680D4ECF5FBDE00BE1104415AE3F3 --renderer-client-id=2 --mojo-platform-channel-handle=1712 --allow-no-sandbox-job /prefetch:14⤵PID:2004
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=30BC5EF9BE1F96EF118E70F281675D5E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=30BC5EF9BE1F96EF118E70F281675D5E --renderer-client-id=4 --mojo-platform-channel-handle=2060 --allow-no-sandbox-job /prefetch:14⤵PID:2072
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7898F7F6D714700C8939803865811E1F --mojo-platform-channel-handle=2460 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4072
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A272A8C0464C996712C01C46668E9D11 --mojo-platform-channel-handle=2492 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3084
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3DBD618A4FEB84B9E415952626F43A43 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2792
-
-
-