Analysis
- max time kernel
153s - max time network
154s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
- Size 1.5MB
- Sample201109-af144ceeqj
- SHA256 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa
- MD5 aad58eb80e1f0be04889d19202296208
- SHA1 0c4b72bb5b16e1831826aa392354d348439dc732
- SHA512 31cfaa3226ef4b0f67f5a4c71d6138fbd1bc22d2f519b6fbef76e81ba8b735925036c218ebadeed4a0a860c2e22b8ed56163d6af1dbb072c22cfcca93f96c00a
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 85 IoCs
pid Process 828 DouTuDaShi.exe 1500 dejptp.exe 1584 dejptp.exe 1640 483981.exe 1548 483981.exe 1492 356912.exe 592 356912.exe 752 153795.exe 1236 153795.exe 1900 159943.exe 1828 159943.exe 940 362657.exe 1296 362657.exe 1000 923617.exe 2092 923617.exe 2156 168749.exe 2212 168749.exe 2308 580973.exe 2364 580973.exe 2476 000396.exe 2536 000396.exe 2668 355428.exe 2720 355428.exe 2756 599657.exe 2792 599657.exe 2960 539400.exe 2996 539400.exe 2148 294529.exe 2200 294529.exe 2380 816732.exe 2396 816732.exe 2580 991319.exe 2620 991319.exe 1376 786402.exe 2848 786402.exe 3024 073191.exe 3060 073191.exe 2132 878604.exe 2164 878604.exe 2256 228638.exe 2236 228638.exe 2312 368963.exe 2412 368963.exe 2576 187107.exe 2612 187107.exe 2660 053084.exe 2668 053084.exe 1968 011946.exe 1960 011946.exe 2796 931564.exe 2828 931564.exe 2848 887520.exe 812 887520.exe 2884 347663.exe 2928 347663.exe 732 285645.exe 1800 285645.exe 1316 690366.exe 3060 690366.exe 2056 016667.exe 904 016667.exe 1948 077646.exe 2064 077646.exe 2124 127528.exe 2160 127528.exe 2220 573057.exe 2212 573057.exe 2260 432037.exe 2196 432037.exe 1944 579092.exe 2328 579092.exe 2348 436157.exe 2408 436157.exe 2588 273222.exe 2596 273222.exe 2512 688934.exe 2724 688934.exe 1764 483184.exe 1192 483184.exe 1960 340249.exe 1976 340249.exe 2792 694768.exe 2784 694768.exe 1008 631823.exe 812 631823.exe - Loads dropped DLL 86 IoCs
pid Process 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 1500 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\DouTu\DouTuDaShi.exe 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "90" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "854" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000033044fc40189d459fe40d0e3dcc9b6600000000020000000000106600000001000020000000d3ec779e54c8edf5f55e04a4eb4227b99fd22d235dd9a49b874ff0d2e505be66000000000e800000000200002000000062e4cf171ad39098a9ceb2a0d2ab340142cb7725bfd3063e3072a64e83a89eb3200000004b073fe530ba1ba0cbb3a3e8047289afa51e146fbb3a653a5c786c3b25702310400000001f01a26c05551cf8f05e5afc90a7e79390ba23d4928263670f6fdb8433f065773ea086d27b8867aaf619bc82a02ba0add01e9737412caa97f9f9991277faaa4a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "854" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "380" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "26240" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "380" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "86946" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC20D731-23C9-11EB-85AD-520DDC0DB10A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "90" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "214" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "26240" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "86974" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "26263" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "26240" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "214" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "286" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "11992" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "214" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "286" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "729" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "729" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "84259" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09eb6dfd6b7d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "90" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "286" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "86946" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "86974" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "311828522" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "11992" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "84259" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main DouTuDaShi.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "729" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "854" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000033044fc40189d459fe40d0e3dcc9b660000000002000000000010660000000100002000000028b6d247d7baedf8cb945ed52b88f38663bc9c73d56f2dda6b565d798022cc05000000000e800000000200002000000046e726680e8a63d4790cfb5a876090f057106ff1d3fe0d72733fa5f595e634b290000000378eb6a031937b009d379dfab8d5cfbf4e15eb7ffe2c2f525f37ce9eef443074c23c83b89a0fe03f262131844f3a690dde465095e6bb641ce466aad91b730fa5d891dd760483ec788a25f6cdea516d88677775698179f5bf25bc8f35f5eb180c939c8502e8493eca7a0072483137ec4ec308c6967cbbf6c6755a74f0bcbcb5d58959325791cc092c285979218f6434df400000009d75df67a1f4d520d7ab8cff5715919117a6c4aa2dcac38fabc424a9f83caa35b809f8fdea584d85eac67f1dd4340673bdd24bb525a25e4d5cfcfd27228d5d36 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "380" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "86946" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "933" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "933" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "26263" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "26263" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "84259" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "933" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "11992" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "86974" IEXPLORE.EXE - Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe 1584 dejptp.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 2452 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2452 AUDIODG.EXE Token: 33 2452 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2452 AUDIODG.EXE Token: 33 1224 IEXPLORE.EXE Token: SeIncBasePriorityPrivilege 1224 IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 384 iexplore.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 828 DouTuDaShi.exe 828 DouTuDaShi.exe 828 DouTuDaShi.exe 828 DouTuDaShi.exe 384 iexplore.exe 384 iexplore.exe 1224 IEXPLORE.EXE 1224 IEXPLORE.EXE 1224 IEXPLORE.EXE 1224 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 355 IoCs
description pid Process procid_target PID 788 wrote to memory of 828 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 30 PID 788 wrote to memory of 828 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 30 PID 788 wrote to memory of 828 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 30 PID 788 wrote to memory of 828 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 30 PID 788 wrote to memory of 1500 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 32 PID 788 wrote to memory of 1500 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 32 PID 788 wrote to memory of 1500 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 32 PID 788 wrote to memory of 1500 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 32 PID 1500 wrote to memory of 1584 1500 dejptp.exe 33 PID 1500 wrote to memory of 1584 1500 dejptp.exe 33 PID 1500 wrote to memory of 1584 1500 dejptp.exe 33 PID 1500 wrote to memory of 1584 1500 dejptp.exe 33 PID 1584 wrote to memory of 1640 1584 dejptp.exe 35 PID 1584 wrote to memory of 1640 1584 dejptp.exe 35 PID 1584 wrote to memory of 1640 1584 dejptp.exe 35 PID 1584 wrote to memory of 1640 1584 dejptp.exe 35 PID 1640 wrote to memory of 1548 1640 483981.exe 36 PID 1640 wrote to memory of 1548 1640 483981.exe 36 PID 1640 wrote to memory of 1548 1640 483981.exe 36 PID 1640 wrote to memory of 1548 1640 483981.exe 36 PID 1584 wrote to memory of 1492 1584 dejptp.exe 37 PID 1584 wrote to memory of 1492 1584 dejptp.exe 37 PID 1584 wrote to memory of 1492 1584 dejptp.exe 37 PID 1584 wrote to memory of 1492 1584 dejptp.exe 37 PID 1492 wrote to memory of 592 1492 356912.exe 38 PID 1492 wrote to memory of 592 1492 356912.exe 38 PID 1492 wrote to memory of 592 1492 356912.exe 38 PID 1492 wrote to memory of 592 1492 356912.exe 38 PID 788 wrote to memory of 384 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 39 PID 788 wrote to memory of 384 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 39 PID 788 wrote to memory of 384 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 39 PID 788 wrote to memory of 384 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 39 PID 788 wrote to memory of 964 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 40 PID 788 wrote to memory of 964 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 40 PID 788 wrote to memory of 964 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 40 PID 788 wrote to memory of 964 788 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe 40 PID 904 wrote to memory of 1352 904 explorer.exe 42 PID 904 wrote to memory of 1352 904 explorer.exe 42 PID 904 wrote to memory of 1352 904 explorer.exe 42 PID 384 wrote to memory of 1224 384 iexplore.exe 44 PID 384 wrote to memory of 1224 384 iexplore.exe 44 PID 384 wrote to memory of 1224 384 iexplore.exe 44 PID 384 wrote to memory of 1224 384 iexplore.exe 44 PID 1584 wrote to memory of 752 1584 dejptp.exe 45 PID 1584 wrote to memory of 752 1584 dejptp.exe 45 PID 1584 wrote to memory of 752 1584 dejptp.exe 45 PID 1584 wrote to memory of 752 1584 dejptp.exe 45 PID 752 wrote to memory of 1236 752 153795.exe 46 PID 752 wrote to memory of 1236 752 153795.exe 46 PID 752 wrote to memory of 1236 752 153795.exe 46 PID 752 wrote to memory of 1236 752 153795.exe 46 PID 1584 wrote to memory of 1900 1584 dejptp.exe 47 PID 1584 wrote to memory of 1900 1584 dejptp.exe 47 PID 1584 wrote to memory of 1900 1584 dejptp.exe 47 PID 1584 wrote to memory of 1900 1584 dejptp.exe 47 PID 1900 wrote to memory of 1828 1900 159943.exe 49 PID 1900 wrote to memory of 1828 1900 159943.exe 49 PID 1900 wrote to memory of 1828 1900 159943.exe 49 PID 1900 wrote to memory of 1828 1900 159943.exe 49 PID 1584 wrote to memory of 940 1584 dejptp.exe 50 PID 1584 wrote to memory of 940 1584 dejptp.exe 50 PID 1584 wrote to memory of 940 1584 dejptp.exe 50 PID 1584 wrote to memory of 940 1584 dejptp.exe 50 PID 940 wrote to memory of 1296 940 362657.exe 51 PID 940 wrote to memory of 1296 940 362657.exe 51 PID 940 wrote to memory of 1296 940 362657.exe 51 PID 940 wrote to memory of 1296 940 362657.exe 51 PID 1584 wrote to memory of 1000 1584 dejptp.exe 52 PID 1584 wrote to memory of 1000 1584 dejptp.exe 52 PID 1584 wrote to memory of 1000 1584 dejptp.exe 52 PID 1584 wrote to memory of 1000 1584 dejptp.exe 52 PID 1000 wrote to memory of 2092 1000 923617.exe 53 PID 1000 wrote to memory of 2092 1000 923617.exe 53 PID 1000 wrote to memory of 2092 1000 923617.exe 53 PID 1000 wrote to memory of 2092 1000 923617.exe 53 PID 1584 wrote to memory of 2156 1584 dejptp.exe 54 PID 1584 wrote to memory of 2156 1584 dejptp.exe 54 PID 1584 wrote to memory of 2156 1584 dejptp.exe 54 PID 1584 wrote to memory of 2156 1584 dejptp.exe 54 PID 2156 wrote to memory of 2212 2156 168749.exe 55 PID 2156 wrote to memory of 2212 2156 168749.exe 55 PID 2156 wrote to memory of 2212 2156 168749.exe 55 PID 2156 wrote to memory of 2212 2156 168749.exe 55 PID 1584 wrote to memory of 2308 1584 dejptp.exe 56 PID 1584 wrote to memory of 2308 1584 dejptp.exe 56 PID 1584 wrote to memory of 2308 1584 dejptp.exe 56 PID 1584 wrote to memory of 2308 1584 dejptp.exe 56 PID 2308 wrote to memory of 2364 2308 580973.exe 57 PID 2308 wrote to memory of 2364 2308 580973.exe 57 PID 2308 wrote to memory of 2364 2308 580973.exe 57 PID 2308 wrote to memory of 2364 2308 580973.exe 57 PID 1584 wrote to memory of 2476 1584 dejptp.exe 58 PID 1584 wrote to memory of 2476 1584 dejptp.exe 58 PID 1584 wrote to memory of 2476 1584 dejptp.exe 58 PID 1584 wrote to memory of 2476 1584 dejptp.exe 58 PID 2476 wrote to memory of 2536 2476 000396.exe 59 PID 2476 wrote to memory of 2536 2476 000396.exe 59 PID 2476 wrote to memory of 2536 2476 000396.exe 59 PID 2476 wrote to memory of 2536 2476 000396.exe 59 PID 1584 wrote to memory of 2668 1584 dejptp.exe 60 PID 1584 wrote to memory of 2668 1584 dejptp.exe 60 PID 1584 wrote to memory of 2668 1584 dejptp.exe 60 PID 1584 wrote to memory of 2668 1584 dejptp.exe 60 PID 2668 wrote to memory of 2720 2668 355428.exe 61 PID 2668 wrote to memory of 2720 2668 355428.exe 61 PID 2668 wrote to memory of 2720 2668 355428.exe 61 PID 2668 wrote to memory of 2720 2668 355428.exe 61 PID 1584 wrote to memory of 2756 1584 dejptp.exe 62 PID 1584 wrote to memory of 2756 1584 dejptp.exe 62 PID 1584 wrote to memory of 2756 1584 dejptp.exe 62 PID 1584 wrote to memory of 2756 1584 dejptp.exe 62 PID 2756 wrote to memory of 2792 2756 599657.exe 63 PID 2756 wrote to memory of 2792 2756 599657.exe 63 PID 2756 wrote to memory of 2792 2756 599657.exe 63 PID 2756 wrote to memory of 2792 2756 599657.exe 63 PID 1584 wrote to memory of 2960 1584 dejptp.exe 64 PID 1584 wrote to memory of 2960 1584 dejptp.exe 64 PID 1584 wrote to memory of 2960 1584 dejptp.exe 64 PID 1584 wrote to memory of 2960 1584 dejptp.exe 64 PID 2960 wrote to memory of 2996 2960 539400.exe 65 PID 2960 wrote to memory of 2996 2960 539400.exe 65 PID 2960 wrote to memory of 2996 2960 539400.exe 65 PID 2960 wrote to memory of 2996 2960 539400.exe 65 PID 1584 wrote to memory of 2148 1584 dejptp.exe 66 PID 1584 wrote to memory of 2148 1584 dejptp.exe 66 PID 1584 wrote to memory of 2148 1584 dejptp.exe 66 PID 1584 wrote to memory of 2148 1584 dejptp.exe 66 PID 2148 wrote to memory of 2200 2148 294529.exe 67 PID 2148 wrote to memory of 2200 2148 294529.exe 67 PID 2148 wrote to memory of 2200 2148 294529.exe 67 PID 2148 wrote to memory of 2200 2148 294529.exe 67 PID 1584 wrote to memory of 2380 1584 dejptp.exe 68 PID 1584 wrote to memory of 2380 1584 dejptp.exe 68 PID 1584 wrote to memory of 2380 1584 dejptp.exe 68 PID 1584 wrote to memory of 2380 1584 dejptp.exe 68 PID 2380 wrote to memory of 2396 2380 816732.exe 69 PID 2380 wrote to memory of 2396 2380 816732.exe 69 PID 2380 wrote to memory of 2396 2380 816732.exe 69 PID 2380 wrote to memory of 2396 2380 816732.exe 69 PID 1584 wrote to memory of 2580 1584 dejptp.exe 70 PID 1584 wrote to memory of 2580 1584 dejptp.exe 70 PID 1584 wrote to memory of 2580 1584 dejptp.exe 70 PID 1584 wrote to memory of 2580 1584 dejptp.exe 70 PID 2580 wrote to memory of 2620 2580 991319.exe 71 PID 2580 wrote to memory of 2620 2580 991319.exe 71 PID 2580 wrote to memory of 2620 2580 991319.exe 71 PID 2580 wrote to memory of 2620 2580 991319.exe 71 PID 1584 wrote to memory of 1376 1584 dejptp.exe 72 PID 1584 wrote to memory of 1376 1584 dejptp.exe 72 PID 1584 wrote to memory of 1376 1584 dejptp.exe 72 PID 1584 wrote to memory of 1376 1584 dejptp.exe 72 PID 1376 wrote to memory of 2848 1376 786402.exe 73 PID 1376 wrote to memory of 2848 1376 786402.exe 73 PID 1376 wrote to memory of 2848 1376 786402.exe 73 PID 1376 wrote to memory of 2848 1376 786402.exe 73 PID 1584 wrote to memory of 3024 1584 dejptp.exe 74 PID 1584 wrote to memory of 3024 1584 dejptp.exe 74 PID 1584 wrote to memory of 3024 1584 dejptp.exe 74 PID 1584 wrote to memory of 3024 1584 dejptp.exe 74 PID 3024 wrote to memory of 3060 3024 073191.exe 75 PID 3024 wrote to memory of 3060 3024 073191.exe 75 PID 3024 wrote to memory of 3060 3024 073191.exe 75 PID 3024 wrote to memory of 3060 3024 073191.exe 75 PID 1584 wrote to memory of 2132 1584 dejptp.exe 76 PID 1584 wrote to memory of 2132 1584 dejptp.exe 76 PID 1584 wrote to memory of 2132 1584 dejptp.exe 76 PID 1584 wrote to memory of 2132 1584 dejptp.exe 76 PID 2132 wrote to memory of 2164 2132 878604.exe 77 PID 2132 wrote to memory of 2164 2132 878604.exe 77 PID 2132 wrote to memory of 2164 2132 878604.exe 77 PID 2132 wrote to memory of 2164 2132 878604.exe 77 PID 1584 wrote to memory of 2256 1584 dejptp.exe 78 PID 1584 wrote to memory of 2256 1584 dejptp.exe 78 PID 1584 wrote to memory of 2256 1584 dejptp.exe 78 PID 1584 wrote to memory of 2256 1584 dejptp.exe 78 PID 2256 wrote to memory of 2236 2256 228638.exe 79 PID 2256 wrote to memory of 2236 2256 228638.exe 79 PID 2256 wrote to memory of 2236 2256 228638.exe 79 PID 2256 wrote to memory of 2236 2256 228638.exe 79 PID 1584 wrote to memory of 2312 1584 dejptp.exe 80 PID 1584 wrote to memory of 2312 1584 dejptp.exe 80 PID 1584 wrote to memory of 2312 1584 dejptp.exe 80 PID 1584 wrote to memory of 2312 1584 dejptp.exe 80 PID 2312 wrote to memory of 2412 2312 368963.exe 81 PID 2312 wrote to memory of 2412 2312 368963.exe 81 PID 2312 wrote to memory of 2412 2312 368963.exe 81 PID 2312 wrote to memory of 2412 2312 368963.exe 81 PID 1584 wrote to memory of 2576 1584 dejptp.exe 83 PID 1584 wrote to memory of 2576 1584 dejptp.exe 83 PID 1584 wrote to memory of 2576 1584 dejptp.exe 83 PID 1584 wrote to memory of 2576 1584 dejptp.exe 83 PID 2576 wrote to memory of 2612 2576 187107.exe 84 PID 2576 wrote to memory of 2612 2576 187107.exe 84 PID 2576 wrote to memory of 2612 2576 187107.exe 84 PID 2576 wrote to memory of 2612 2576 187107.exe 84 PID 1584 wrote to memory of 2660 1584 dejptp.exe 85 PID 1584 wrote to memory of 2660 1584 dejptp.exe 85 PID 1584 wrote to memory of 2660 1584 dejptp.exe 85 PID 1584 wrote to memory of 2660 1584 dejptp.exe 85 PID 2660 wrote to memory of 2668 2660 053084.exe 86 PID 2660 wrote to memory of 2668 2660 053084.exe 86 PID 2660 wrote to memory of 2668 2660 053084.exe 86 PID 2660 wrote to memory of 2668 2660 053084.exe 86 PID 1584 wrote to memory of 1968 1584 dejptp.exe 87 PID 1584 wrote to memory of 1968 1584 dejptp.exe 87 PID 1584 wrote to memory of 1968 1584 dejptp.exe 87 PID 1584 wrote to memory of 1968 1584 dejptp.exe 87 PID 1968 wrote to memory of 1960 1968 011946.exe 88 PID 1968 wrote to memory of 1960 1968 011946.exe 88 PID 1968 wrote to memory of 1960 1968 011946.exe 88 PID 1968 wrote to memory of 1960 1968 011946.exe 88 PID 1584 wrote to memory of 2796 1584 dejptp.exe 89 PID 1584 wrote to memory of 2796 1584 dejptp.exe 89 PID 1584 wrote to memory of 2796 1584 dejptp.exe 89 PID 1584 wrote to memory of 2796 1584 dejptp.exe 89 PID 2796 wrote to memory of 2828 2796 931564.exe 90 PID 2796 wrote to memory of 2828 2796 931564.exe 90 PID 2796 wrote to memory of 2828 2796 931564.exe 90 PID 2796 wrote to memory of 2828 2796 931564.exe 90 PID 1584 wrote to memory of 2848 1584 dejptp.exe 91 PID 1584 wrote to memory of 2848 1584 dejptp.exe 91 PID 1584 wrote to memory of 2848 1584 dejptp.exe 91 PID 1584 wrote to memory of 2848 1584 dejptp.exe 91 PID 2848 wrote to memory of 812 2848 887520.exe 92 PID 2848 wrote to memory of 812 2848 887520.exe 92 PID 2848 wrote to memory of 812 2848 887520.exe 92 PID 2848 wrote to memory of 812 2848 887520.exe 92 PID 1584 wrote to memory of 2884 1584 dejptp.exe 93 PID 1584 wrote to memory of 2884 1584 dejptp.exe 93 PID 1584 wrote to memory of 2884 1584 dejptp.exe 93 PID 1584 wrote to memory of 2884 1584 dejptp.exe 93 PID 2884 wrote to memory of 2928 2884 347663.exe 94 PID 2884 wrote to memory of 2928 2884 347663.exe 94 PID 2884 wrote to memory of 2928 2884 347663.exe 94 PID 2884 wrote to memory of 2928 2884 347663.exe 94 PID 1584 wrote to memory of 732 1584 dejptp.exe 95 PID 1584 wrote to memory of 732 1584 dejptp.exe 95 PID 1584 wrote to memory of 732 1584 dejptp.exe 95 PID 1584 wrote to memory of 732 1584 dejptp.exe 95 PID 732 wrote to memory of 1800 732 285645.exe 96 PID 732 wrote to memory of 1800 732 285645.exe 96 PID 732 wrote to memory of 1800 732 285645.exe 96 PID 732 wrote to memory of 1800 732 285645.exe 96 PID 1584 wrote to memory of 1316 1584 dejptp.exe 97 PID 1584 wrote to memory of 1316 1584 dejptp.exe 97 PID 1584 wrote to memory of 1316 1584 dejptp.exe 97 PID 1584 wrote to memory of 1316 1584 dejptp.exe 97 PID 1316 wrote to memory of 3060 1316 690366.exe 98 PID 1316 wrote to memory of 3060 1316 690366.exe 98 PID 1316 wrote to memory of 3060 1316 690366.exe 98 PID 1316 wrote to memory of 3060 1316 690366.exe 98 PID 1584 wrote to memory of 2056 1584 dejptp.exe 99 PID 1584 wrote to memory of 2056 1584 dejptp.exe 99 PID 1584 wrote to memory of 2056 1584 dejptp.exe 99 PID 1584 wrote to memory of 2056 1584 dejptp.exe 99 PID 2056 wrote to memory of 904 2056 016667.exe 100 PID 2056 wrote to memory of 904 2056 016667.exe 100 PID 2056 wrote to memory of 904 2056 016667.exe 100 PID 2056 wrote to memory of 904 2056 016667.exe 100 PID 1584 wrote to memory of 1948 1584 dejptp.exe 101 PID 1584 wrote to memory of 1948 1584 dejptp.exe 101 PID 1584 wrote to memory of 1948 1584 dejptp.exe 101 PID 1584 wrote to memory of 1948 1584 dejptp.exe 101 PID 1948 wrote to memory of 2064 1948 077646.exe 102 PID 1948 wrote to memory of 2064 1948 077646.exe 102 PID 1948 wrote to memory of 2064 1948 077646.exe 102 PID 1948 wrote to memory of 2064 1948 077646.exe 102 PID 1584 wrote to memory of 2124 1584 dejptp.exe 103 PID 1584 wrote to memory of 2124 1584 dejptp.exe 103 PID 1584 wrote to memory of 2124 1584 dejptp.exe 103 PID 1584 wrote to memory of 2124 1584 dejptp.exe 103 PID 2124 wrote to memory of 2160 2124 127528.exe 104 PID 2124 wrote to memory of 2160 2124 127528.exe 104 PID 2124 wrote to memory of 2160 2124 127528.exe 104 PID 2124 wrote to memory of 2160 2124 127528.exe 104 PID 1584 wrote to memory of 2220 1584 dejptp.exe 105 PID 1584 wrote to memory of 2220 1584 dejptp.exe 105 PID 1584 wrote to memory of 2220 1584 dejptp.exe 105 PID 1584 wrote to memory of 2220 1584 dejptp.exe 105 PID 2220 wrote to memory of 2212 2220 573057.exe 106 PID 2220 wrote to memory of 2212 2220 573057.exe 106 PID 2220 wrote to memory of 2212 2220 573057.exe 106 PID 2220 wrote to memory of 2212 2220 573057.exe 106 PID 1584 wrote to memory of 2260 1584 dejptp.exe 107 PID 1584 wrote to memory of 2260 1584 dejptp.exe 107 PID 1584 wrote to memory of 2260 1584 dejptp.exe 107 PID 1584 wrote to memory of 2260 1584 dejptp.exe 107 PID 2260 wrote to memory of 2196 2260 432037.exe 108 PID 2260 wrote to memory of 2196 2260 432037.exe 108 PID 2260 wrote to memory of 2196 2260 432037.exe 108 PID 2260 wrote to memory of 2196 2260 432037.exe 108 PID 1584 wrote to memory of 1944 1584 dejptp.exe 109 PID 1584 wrote to memory of 1944 1584 dejptp.exe 109 PID 1584 wrote to memory of 1944 1584 dejptp.exe 109 PID 1584 wrote to memory of 1944 1584 dejptp.exe 109 PID 1944 wrote to memory of 2328 1944 579092.exe 110 PID 1944 wrote to memory of 2328 1944 579092.exe 110 PID 1944 wrote to memory of 2328 1944 579092.exe 110 PID 1944 wrote to memory of 2328 1944 579092.exe 110 PID 1584 wrote to memory of 2348 1584 dejptp.exe 111 PID 1584 wrote to memory of 2348 1584 dejptp.exe 111 PID 1584 wrote to memory of 2348 1584 dejptp.exe 111 PID 1584 wrote to memory of 2348 1584 dejptp.exe 111 PID 2348 wrote to memory of 2408 2348 436157.exe 112 PID 2348 wrote to memory of 2408 2348 436157.exe 112 PID 2348 wrote to memory of 2408 2348 436157.exe 112 PID 2348 wrote to memory of 2408 2348 436157.exe 112 PID 1584 wrote to memory of 2588 1584 dejptp.exe 113 PID 1584 wrote to memory of 2588 1584 dejptp.exe 113 PID 1584 wrote to memory of 2588 1584 dejptp.exe 113 PID 1584 wrote to memory of 2588 1584 dejptp.exe 113 PID 2588 wrote to memory of 2596 2588 273222.exe 114 PID 2588 wrote to memory of 2596 2588 273222.exe 114 PID 2588 wrote to memory of 2596 2588 273222.exe 114 PID 2588 wrote to memory of 2596 2588 273222.exe 114 PID 1584 wrote to memory of 2512 1584 dejptp.exe 115 PID 1584 wrote to memory of 2512 1584 dejptp.exe 115 PID 1584 wrote to memory of 2512 1584 dejptp.exe 115 PID 1584 wrote to memory of 2512 1584 dejptp.exe 115 PID 2512 wrote to memory of 2724 2512 688934.exe 116 PID 2512 wrote to memory of 2724 2512 688934.exe 116 PID 2512 wrote to memory of 2724 2512 688934.exe 116 PID 2512 wrote to memory of 2724 2512 688934.exe 116 PID 1584 wrote to memory of 1764 1584 dejptp.exe 117 PID 1584 wrote to memory of 1764 1584 dejptp.exe 117 PID 1584 wrote to memory of 1764 1584 dejptp.exe 117 PID 1584 wrote to memory of 1764 1584 dejptp.exe 117 PID 1764 wrote to memory of 1192 1764 483184.exe 118 PID 1764 wrote to memory of 1192 1764 483184.exe 118 PID 1764 wrote to memory of 1192 1764 483184.exe 118 PID 1764 wrote to memory of 1192 1764 483184.exe 118 PID 1584 wrote to memory of 1960 1584 dejptp.exe 119 PID 1584 wrote to memory of 1960 1584 dejptp.exe 119 PID 1584 wrote to memory of 1960 1584 dejptp.exe 119 PID 1584 wrote to memory of 1960 1584 dejptp.exe 119 PID 1960 wrote to memory of 1976 1960 340249.exe 120 PID 1960 wrote to memory of 1976 1960 340249.exe 120 PID 1960 wrote to memory of 1976 1960 340249.exe 120 PID 1960 wrote to memory of 1976 1960 340249.exe 120 PID 1584 wrote to memory of 2792 1584 dejptp.exe 121 PID 1584 wrote to memory of 2792 1584 dejptp.exe 121 PID 1584 wrote to memory of 2792 1584 dejptp.exe 121 PID 1584 wrote to memory of 2792 1584 dejptp.exe 121 PID 2792 wrote to memory of 2784 2792 694768.exe 122 PID 2792 wrote to memory of 2784 2792 694768.exe 122 PID 2792 wrote to memory of 2784 2792 694768.exe 122 PID 2792 wrote to memory of 2784 2792 694768.exe 122 PID 1584 wrote to memory of 1008 1584 dejptp.exe 123 PID 1584 wrote to memory of 1008 1584 dejptp.exe 123 PID 1584 wrote to memory of 1008 1584 dejptp.exe 123 PID 1584 wrote to memory of 1008 1584 dejptp.exe 123 PID 1008 wrote to memory of 812 1008 631823.exe 124 PID 1008 wrote to memory of 812 1008 631823.exe 124 PID 1008 wrote to memory of 812 1008 631823.exe 124 PID 1008 wrote to memory of 812 1008 631823.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe"C:\Users\Admin\AppData\Local\Temp\8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:828
-
-
C:\Users\Admin\AppData\Local\Temp\dejptp.exe"C:\Users\Admin\AppData\Local\Temp\dejptp.exe" /jscxyxztjkl2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\dejptp.exe"C:\Users\Admin\AppData\Local\Temp\dejptp.exe" /jsjczxztcq3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Roaming\Download\483981.exe"C:\Users\Admin\AppData\Roaming\Download\483981.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Roaming\Download\483981.exe"C:\Users\Admin\AppData\Roaming\Download\483981.exe"5⤵
- Executes dropped EXE
PID:1548
-
-
-
C:\Users\Admin\AppData\Roaming\Download\356912.exe"C:\Users\Admin\AppData\Roaming\Download\356912.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Roaming\Download\356912.exe"C:\Users\Admin\AppData\Roaming\Download\356912.exe"5⤵
- Executes dropped EXE
PID:592
-
-
-
C:\Users\Admin\AppData\Roaming\Download\153795.exe"C:\Users\Admin\AppData\Roaming\Download\153795.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Roaming\Download\153795.exe"C:\Users\Admin\AppData\Roaming\Download\153795.exe"5⤵
- Executes dropped EXE
PID:1236
-
-
-
C:\Users\Admin\AppData\Roaming\Download\159943.exe"C:\Users\Admin\AppData\Roaming\Download\159943.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Roaming\Download\159943.exe"C:\Users\Admin\AppData\Roaming\Download\159943.exe"5⤵
- Executes dropped EXE
PID:1828
-
-
-
C:\Users\Admin\AppData\Roaming\Download\362657.exe"C:\Users\Admin\AppData\Roaming\Download\362657.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Roaming\Download\362657.exe"C:\Users\Admin\AppData\Roaming\Download\362657.exe"5⤵
- Executes dropped EXE
PID:1296
-
-
-
C:\Users\Admin\AppData\Roaming\Download\923617.exe"C:\Users\Admin\AppData\Roaming\Download\923617.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Roaming\Download\923617.exe"C:\Users\Admin\AppData\Roaming\Download\923617.exe"5⤵
- Executes dropped EXE
PID:2092
-
-
-
C:\Users\Admin\AppData\Roaming\Download\168749.exe"C:\Users\Admin\AppData\Roaming\Download\168749.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Roaming\Download\168749.exe"C:\Users\Admin\AppData\Roaming\Download\168749.exe"5⤵
- Executes dropped EXE
PID:2212
-
-
-
C:\Users\Admin\AppData\Roaming\Download\580973.exe"C:\Users\Admin\AppData\Roaming\Download\580973.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Roaming\Download\580973.exe"C:\Users\Admin\AppData\Roaming\Download\580973.exe"5⤵
- Executes dropped EXE
PID:2364
-
-
-
C:\Users\Admin\AppData\Roaming\Download\000396.exe"C:\Users\Admin\AppData\Roaming\Download\000396.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Roaming\Download\000396.exe"C:\Users\Admin\AppData\Roaming\Download\000396.exe"5⤵
- Executes dropped EXE
PID:2536
-
-
-
C:\Users\Admin\AppData\Roaming\Download\355428.exe"C:\Users\Admin\AppData\Roaming\Download\355428.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Roaming\Download\355428.exe"C:\Users\Admin\AppData\Roaming\Download\355428.exe"5⤵
- Executes dropped EXE
PID:2720
-
-
-
C:\Users\Admin\AppData\Roaming\Download\599657.exe"C:\Users\Admin\AppData\Roaming\Download\599657.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Roaming\Download\599657.exe"C:\Users\Admin\AppData\Roaming\Download\599657.exe"5⤵
- Executes dropped EXE
PID:2792
-
-
-
C:\Users\Admin\AppData\Roaming\Download\539400.exe"C:\Users\Admin\AppData\Roaming\Download\539400.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Roaming\Download\539400.exe"C:\Users\Admin\AppData\Roaming\Download\539400.exe"5⤵
- Executes dropped EXE
PID:2996
-
-
-
C:\Users\Admin\AppData\Roaming\Download\294529.exe"C:\Users\Admin\AppData\Roaming\Download\294529.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Roaming\Download\294529.exe"C:\Users\Admin\AppData\Roaming\Download\294529.exe"5⤵
- Executes dropped EXE
PID:2200
-
-
-
C:\Users\Admin\AppData\Roaming\Download\816732.exe"C:\Users\Admin\AppData\Roaming\Download\816732.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Roaming\Download\816732.exe"C:\Users\Admin\AppData\Roaming\Download\816732.exe"5⤵
- Executes dropped EXE
PID:2396
-
-
-
C:\Users\Admin\AppData\Roaming\Download\991319.exe"C:\Users\Admin\AppData\Roaming\Download\991319.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Roaming\Download\991319.exe"C:\Users\Admin\AppData\Roaming\Download\991319.exe"5⤵
- Executes dropped EXE
PID:2620
-
-
-
C:\Users\Admin\AppData\Roaming\Download\786402.exe"C:\Users\Admin\AppData\Roaming\Download\786402.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Roaming\Download\786402.exe"C:\Users\Admin\AppData\Roaming\Download\786402.exe"5⤵
- Executes dropped EXE
PID:2848
-
-
-
C:\Users\Admin\AppData\Roaming\Download\073191.exe"C:\Users\Admin\AppData\Roaming\Download\073191.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Roaming\Download\073191.exe"C:\Users\Admin\AppData\Roaming\Download\073191.exe"5⤵
- Executes dropped EXE
PID:3060
-
-
-
C:\Users\Admin\AppData\Roaming\Download\878604.exe"C:\Users\Admin\AppData\Roaming\Download\878604.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Roaming\Download\878604.exe"C:\Users\Admin\AppData\Roaming\Download\878604.exe"5⤵
- Executes dropped EXE
PID:2164
-
-
-
C:\Users\Admin\AppData\Roaming\Download\228638.exe"C:\Users\Admin\AppData\Roaming\Download\228638.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Roaming\Download\228638.exe"C:\Users\Admin\AppData\Roaming\Download\228638.exe"5⤵
- Executes dropped EXE
PID:2236
-
-
-
C:\Users\Admin\AppData\Roaming\Download\368963.exe"C:\Users\Admin\AppData\Roaming\Download\368963.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Roaming\Download\368963.exe"C:\Users\Admin\AppData\Roaming\Download\368963.exe"5⤵
- Executes dropped EXE
PID:2412
-
-
-
C:\Users\Admin\AppData\Roaming\Download\187107.exe"C:\Users\Admin\AppData\Roaming\Download\187107.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Roaming\Download\187107.exe"C:\Users\Admin\AppData\Roaming\Download\187107.exe"5⤵
- Executes dropped EXE
PID:2612
-
-
-
C:\Users\Admin\AppData\Roaming\Download\053084.exe"C:\Users\Admin\AppData\Roaming\Download\053084.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Roaming\Download\053084.exe"C:\Users\Admin\AppData\Roaming\Download\053084.exe"5⤵
- Executes dropped EXE
PID:2668
-
-
-
C:\Users\Admin\AppData\Roaming\Download\011946.exe"C:\Users\Admin\AppData\Roaming\Download\011946.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Roaming\Download\011946.exe"C:\Users\Admin\AppData\Roaming\Download\011946.exe"5⤵
- Executes dropped EXE
PID:1960
-
-
-
C:\Users\Admin\AppData\Roaming\Download\931564.exe"C:\Users\Admin\AppData\Roaming\Download\931564.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Roaming\Download\931564.exe"C:\Users\Admin\AppData\Roaming\Download\931564.exe"5⤵
- Executes dropped EXE
PID:2828
-
-
-
C:\Users\Admin\AppData\Roaming\Download\887520.exe"C:\Users\Admin\AppData\Roaming\Download\887520.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Roaming\Download\887520.exe"C:\Users\Admin\AppData\Roaming\Download\887520.exe"5⤵
- Executes dropped EXE
PID:812
-
-
-
C:\Users\Admin\AppData\Roaming\Download\347663.exe"C:\Users\Admin\AppData\Roaming\Download\347663.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Roaming\Download\347663.exe"C:\Users\Admin\AppData\Roaming\Download\347663.exe"5⤵
- Executes dropped EXE
PID:2928
-
-
-
C:\Users\Admin\AppData\Roaming\Download\285645.exe"C:\Users\Admin\AppData\Roaming\Download\285645.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Roaming\Download\285645.exe"C:\Users\Admin\AppData\Roaming\Download\285645.exe"5⤵
- Executes dropped EXE
PID:1800
-
-
-
C:\Users\Admin\AppData\Roaming\Download\690366.exe"C:\Users\Admin\AppData\Roaming\Download\690366.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Roaming\Download\690366.exe"C:\Users\Admin\AppData\Roaming\Download\690366.exe"5⤵
- Executes dropped EXE
PID:3060
-
-
-
C:\Users\Admin\AppData\Roaming\Download\016667.exe"C:\Users\Admin\AppData\Roaming\Download\016667.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Roaming\Download\016667.exe"C:\Users\Admin\AppData\Roaming\Download\016667.exe"5⤵
- Executes dropped EXE
PID:904
-
-
-
C:\Users\Admin\AppData\Roaming\Download\077646.exe"C:\Users\Admin\AppData\Roaming\Download\077646.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Roaming\Download\077646.exe"C:\Users\Admin\AppData\Roaming\Download\077646.exe"5⤵
- Executes dropped EXE
PID:2064
-
-
-
C:\Users\Admin\AppData\Roaming\Download\127528.exe"C:\Users\Admin\AppData\Roaming\Download\127528.exe" /Shorttailedrestart4⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Roaming\Download\127528.exe"C:\Users\Admin\AppData\Roaming\Download\127528.exe"5⤵PID:2160
-
-
-
C:\Users\Admin\AppData\Roaming\Download\573057.exe"C:\Users\Admin\AppData\Roaming\Download\573057.exe" /Shorttailedrestart4⤵PID:2220
-
C:\Users\Admin\AppData\Roaming\Download\573057.exe"C:\Users\Admin\AppData\Roaming\Download\573057.exe"5⤵PID:2212
-
-
-
C:\Users\Admin\AppData\Roaming\Download\432037.exe"C:\Users\Admin\AppData\Roaming\Download\432037.exe" /Shorttailedrestart4⤵PID:2260
-
C:\Users\Admin\AppData\Roaming\Download\432037.exe"C:\Users\Admin\AppData\Roaming\Download\432037.exe"5⤵PID:2196
-
-
-
C:\Users\Admin\AppData\Roaming\Download\579092.exe"C:\Users\Admin\AppData\Roaming\Download\579092.exe" /Shorttailedrestart4⤵PID:1944
-
C:\Users\Admin\AppData\Roaming\Download\579092.exe"C:\Users\Admin\AppData\Roaming\Download\579092.exe"5⤵PID:2328
-
-
-
C:\Users\Admin\AppData\Roaming\Download\436157.exe"C:\Users\Admin\AppData\Roaming\Download\436157.exe" /Shorttailedrestart4⤵PID:2348
-
C:\Users\Admin\AppData\Roaming\Download\436157.exe"C:\Users\Admin\AppData\Roaming\Download\436157.exe"5⤵PID:2408
-
-
-
C:\Users\Admin\AppData\Roaming\Download\273222.exe"C:\Users\Admin\AppData\Roaming\Download\273222.exe" /Shorttailedrestart4⤵PID:2588
-
C:\Users\Admin\AppData\Roaming\Download\273222.exe"C:\Users\Admin\AppData\Roaming\Download\273222.exe"5⤵PID:2596
-
-
-
C:\Users\Admin\AppData\Roaming\Download\688934.exe"C:\Users\Admin\AppData\Roaming\Download\688934.exe" /Shorttailedrestart4⤵PID:2512
-
C:\Users\Admin\AppData\Roaming\Download\688934.exe"C:\Users\Admin\AppData\Roaming\Download\688934.exe"5⤵PID:2724
-
-
-
C:\Users\Admin\AppData\Roaming\Download\483184.exe"C:\Users\Admin\AppData\Roaming\Download\483184.exe" /Shorttailedrestart4⤵PID:1764
-
C:\Users\Admin\AppData\Roaming\Download\483184.exe"C:\Users\Admin\AppData\Roaming\Download\483184.exe"5⤵PID:1192
-
-
-
C:\Users\Admin\AppData\Roaming\Download\340249.exe"C:\Users\Admin\AppData\Roaming\Download\340249.exe" /Shorttailedrestart4⤵PID:1960
-
C:\Users\Admin\AppData\Roaming\Download\340249.exe"C:\Users\Admin\AppData\Roaming\Download\340249.exe"5⤵PID:1976
-
-
-
C:\Users\Admin\AppData\Roaming\Download\694768.exe"C:\Users\Admin\AppData\Roaming\Download\694768.exe" /Shorttailedrestart4⤵PID:2792
-
C:\Users\Admin\AppData\Roaming\Download\694768.exe"C:\Users\Admin\AppData\Roaming\Download\694768.exe"5⤵PID:2784
-
-
-
C:\Users\Admin\AppData\Roaming\Download\631823.exe"C:\Users\Admin\AppData\Roaming\Download\631823.exe" /Shorttailedrestart4⤵PID:1008
-
C:\Users\Admin\AppData\Roaming\Download\631823.exe"C:\Users\Admin\AppData\Roaming\Download\631823.exe"5⤵PID:812
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:384 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1224
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵PID:964
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵PID:1352
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1a01⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452