Analysis
- max time kernel
49s - max time network
71s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
4e8f1cfc39def8ec0ae1bd1a40636cdf68afa5a73a8f221d646edc5897b1eca7.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4e8f1cfc39def8ec0ae1bd1a40636cdf68afa5a73a8f221d646edc5897b1eca7.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 4e8f1cfc39def8ec0ae1bd1a40636cdf68afa5a73a8f221d646edc5897b1eca7.exe
- Size 677KB
- Sample201109-vfd4d6qfwe
- SHA256 4e8f1cfc39def8ec0ae1bd1a40636cdf68afa5a73a8f221d646edc5897b1eca7
- MD5 4ee8342524664d5635e489c59dfdf967
- SHA1 ba5287ac432bfde737c06e333f1d50f40eae6048
- SHA512 590b11cbf2877205b32b617c6fcb3cfa4d32cd9cfa4176648b2b32d8bc197dd7c4fc07048ecbf2be280589a12cbfedcdc855732113f3af3c43be8a516f3747cf
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000800000000068f-2.dat aspack_v212_v242 behavioral2/files/0x000800000000068f-1.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3888 eoCbjl.exe - Drops file in Program Files directory 276 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\WinStore.App.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\86.0.4240.111\86.0.4240.111_chrome_installer.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxMail.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxAccounts.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Time.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxClickHandler.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\GameBar.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUMCF92.tmp\GoogleUpdateSetup.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Mail\wab.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Defender\MSASCuiL.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe eoCbjl.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Music.UI.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE eoCbjl.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe eoCbjl.exe File opened for modification C:\Program Files\7-Zip\7zG.exe eoCbjl.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe eoCbjl.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\elevation_service.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteim.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\MessagingApplication.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe eoCbjl.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe eoCbjl.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\chrome_pwa_launcher.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE eoCbjl.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe eoCbjl.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe eoCbjl.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe eoCbjl.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\notification_helper.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0C5D4CDF-5D9D-4019-A7CB-FAAD082B42AB}\CR_8D4CF.tmp\setup.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe eoCbjl.exe File opened for modification C:\Program Files\7-Zip\7z.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe eoCbjl.exe File opened for modification C:\Program Files\LimitPing.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\OneConnect.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0C5D4CDF-5D9D-4019-A7CB-FAAD082B42AB}\86.0.4240.111_chrome_installer.exe eoCbjl.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE eoCbjl.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\SoundRec.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe eoCbjl.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe eoCbjl.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe eoCbjl.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE eoCbjl.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Solitaire.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe eoCbjl.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe eoCbjl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE eoCbjl.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubWin32.exe eoCbjl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe eoCbjl.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe eoCbjl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\PeopleApp.exe eoCbjl.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1036 wrote to memory of 3888 1036 4e8f1cfc39def8ec0ae1bd1a40636cdf68afa5a73a8f221d646edc5897b1eca7.exe 75 PID 1036 wrote to memory of 3888 1036 4e8f1cfc39def8ec0ae1bd1a40636cdf68afa5a73a8f221d646edc5897b1eca7.exe 75 PID 1036 wrote to memory of 3888 1036 4e8f1cfc39def8ec0ae1bd1a40636cdf68afa5a73a8f221d646edc5897b1eca7.exe 75 PID 3888 wrote to memory of 3668 3888 eoCbjl.exe 81 PID 3888 wrote to memory of 3668 3888 eoCbjl.exe 81 PID 3888 wrote to memory of 3668 3888 eoCbjl.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e8f1cfc39def8ec0ae1bd1a40636cdf68afa5a73a8f221d646edc5897b1eca7.exe"C:\Users\Admin\AppData\Local\Temp\4e8f1cfc39def8ec0ae1bd1a40636cdf68afa5a73a8f221d646edc5897b1eca7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\eoCbjl.exeC:\Users\Admin\AppData\Local\Temp\eoCbjl.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\19ad5d43.bat" "3⤵PID:3668
-
-