Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:25
Static task
static1
Behavioral task
behavioral1
Sample
68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe
- Size 355KB
- Sample201109-sa5e59z2va
- SHA256 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2
- MD5 5d25afb224b5499cb35fe152b39e6e1c
- SHA1 7587060e4b541c6b6b66841c96de3d6d7513ca65
- SHA512 06e507bf507cbfb47a1b41f2df55f9a1b46590c4d27f8d0063192b1decbf3e1bd59f4d778873ccbc061d029548d5c2655ba7f0c2645e863a6016d8cb3d616165
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe - Executes dropped EXE 1 IoCs
pid Process 3136 svchost.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\5d4e6384 = "\u009d8ÖêOÛ!:\\qJÌÎZý/Zåý_Þd=\x15)Í6…\b…ëÃK&º.òʲÎnºÕ•#\x1e]ŠV\x1e½}\x066Mæ>F{\x15ºµ=Mæòîf¶\x136ö\x1e…âî\rÎî†\x1e\x1e¥†:–[Î&.Õ^…Õ\x06\x16\x1ef\x06¶µÎΖâ%ÓÝB&N½*‚Þ†F–MÎÅÂNö…b\x06–æ*î\x1e~\x05m³\n&ŽæN>ENZú\n\n.\u008d¾\x15†..Âæ\x1b’f\x0e;…^Í\x06J¦e¶ÍnEÝ^\x06\x06ãÅ\u008dË®v\x06\x05v\"\x06\x1e&U\x16\u008dò\x0eý®Mö¥vUó5&\x05¾å¾††»ý“ÅCm\næU¦JnƒU†ÂÃFFNÚµÞfÒf\x1dcn®.\x05®[Þ¥}ÞÊýv-ºî«&…¶" 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\5d4e6384 = "\u009d8ÖêOÛ!:\\qJÌÎZý/Zåý_Þd=\x15)Í6…\b…ëÃK&º.òʲÎnºÕ•#\x1e]ŠV\x1e½}\x066Mæ>F{\x15ºµ=Mæòîf¶\x136ö\x1e…âî\rÎî†\x1e\x1e¥†:–[Î&.Õ^…Õ\x06\x16\x1ef\x06¶µÎΖâ%ÓÝB&N½*‚Þ†F–MÎÅÂNö…b\x06–æ*î\x1e~\x05m³\n&ŽæN>ENZú\n\n.\u008d¾\x15†..Âæ\x1b’f\x0e;…^Í\x06J¦e¶ÍnEÝ^\x06\x06ãÅ\u008dË®v\x06\x05v\"\x06\x1e&U\x16\u008dò\x0eý®Mö¥vUó5&\x05¾å¾††»ý“ÅCm\næU¦JnƒU†ÂÃFFNÚµÞfÒf\x1dcn®.\x05®[Þ¥}ÞÊýv-ºî«&…¶" svchost.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe File opened for modification C:\Windows\apppatch\svchost.exe 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe - Suspicious behavior: EnumeratesProcesses 882 IoCs
pid Process 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe 3136 svchost.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 480 wrote to memory of 3136 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 76 PID 480 wrote to memory of 3136 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 76 PID 480 wrote to memory of 3136 480 68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe"C:\Users\Admin\AppData\Local\Temp\68e7c82cc5535b87b0e1310f9a054432944b6efa0471e2b03101554bdf7decc2.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
PID:3136
-