Analysis
- max time kernel
130s - max time network
141s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 08:00
Static task
static1
Behavioral task
behavioral1
Sample
a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe
- Size 5.9MB
- Sample201110-ev2e6pcmrx
- SHA256 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4
- MD5 328930035c958f52b5c5b0cf64812ef7
- SHA1 78fc4132e0723c318c23fc56e1d2fa2e12541c6d
- SHA512 4e40901f20c0c24d62f4a89ab8e5be179d79a922a0e90360cdf6ad179350513d185bb0ddb728b9f984b9b7a0c799d196cb80f490954f5f95128bd2b432279c4b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 42 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x00040000000130db-0.dat cobalt_reflective_dll behavioral1/files/0x00040000000130db-2.dat cobalt_reflective_dll behavioral1/files/0x00040000000130dc-3.dat cobalt_reflective_dll behavioral1/files/0x00050000000130df-6.dat cobalt_reflective_dll behavioral1/files/0x00050000000130df-8.dat cobalt_reflective_dll behavioral1/files/0x00040000000130dc-5.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e0-9.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e1-11.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e0-13.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e1-14.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e2-15.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e2-18.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e3-17.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e3-20.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e4-21.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e4-23.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e5-26.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e5-24.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e6-27.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e6-29.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e7-30.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e7-32.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e8-33.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e8-35.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e9-36.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e9-38.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ea-39.dat cobalt_reflective_dll behavioral1/files/0x00030000000130eb-41.dat cobalt_reflective_dll behavioral1/files/0x00030000000130eb-44.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ea-43.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ec-45.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ed-47.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ed-49.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ee-50.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ef-53.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ef-55.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ec-52.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f0-56.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f1-60.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ee-58.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f1-62.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f0-59.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 21 IoCs
pid Process 2012 OMXwlzB.exe 2016 AWkwWma.exe 2040 EnwmnpN.exe 1172 oaAfhIr.exe 1980 ZELQPdo.exe 1816 RRTCBNX.exe 1752 GJCDfYM.exe 1796 ujZoBGV.exe 1732 pptvydt.exe 1340 mMqpVnI.exe 1112 zcWCVMY.exe 1104 ukuzShh.exe 884 lyOtAYM.exe 1352 dbkHweR.exe 1336 OCPtKtu.exe 524 fBXASTg.exe 568 ROuuBdi.exe 1708 qOxWqWe.exe 1128 vWhMRAY.exe 276 KqfuaUS.exe 824 ESMNbGH.exe -
resource yara_rule behavioral1/files/0x00040000000130db-0.dat upx behavioral1/files/0x00040000000130db-2.dat upx behavioral1/files/0x00040000000130dc-3.dat upx behavioral1/files/0x00050000000130df-6.dat upx behavioral1/files/0x00050000000130df-8.dat upx behavioral1/files/0x00040000000130dc-5.dat upx behavioral1/files/0x00030000000130e0-9.dat upx behavioral1/files/0x00030000000130e1-11.dat upx behavioral1/files/0x00030000000130e0-13.dat upx behavioral1/files/0x00030000000130e1-14.dat upx behavioral1/files/0x00030000000130e2-15.dat upx behavioral1/files/0x00030000000130e2-18.dat upx behavioral1/files/0x00030000000130e3-17.dat upx behavioral1/files/0x00030000000130e3-20.dat upx behavioral1/files/0x00030000000130e4-21.dat upx behavioral1/files/0x00030000000130e4-23.dat upx behavioral1/files/0x00030000000130e5-26.dat upx behavioral1/files/0x00030000000130e5-24.dat upx behavioral1/files/0x00030000000130e6-27.dat upx behavioral1/files/0x00030000000130e6-29.dat upx behavioral1/files/0x00030000000130e7-30.dat upx behavioral1/files/0x00030000000130e7-32.dat upx behavioral1/files/0x00030000000130e8-33.dat upx behavioral1/files/0x00030000000130e8-35.dat upx behavioral1/files/0x00030000000130e9-36.dat upx behavioral1/files/0x00030000000130e9-38.dat upx behavioral1/files/0x00030000000130ea-39.dat upx behavioral1/files/0x00030000000130eb-41.dat upx behavioral1/files/0x00030000000130eb-44.dat upx behavioral1/files/0x00030000000130ea-43.dat upx behavioral1/files/0x00030000000130ec-45.dat upx behavioral1/files/0x00030000000130ed-47.dat upx behavioral1/files/0x00030000000130ed-49.dat upx behavioral1/files/0x00030000000130ee-50.dat upx behavioral1/files/0x00030000000130ef-53.dat upx behavioral1/files/0x00030000000130ef-55.dat upx behavioral1/files/0x00030000000130ec-52.dat upx behavioral1/files/0x00030000000130f0-56.dat upx behavioral1/files/0x00030000000130f1-60.dat upx behavioral1/files/0x00030000000130ee-58.dat upx behavioral1/files/0x00030000000130f1-62.dat upx behavioral1/files/0x00030000000130f0-59.dat upx - Loads dropped DLL 21 IoCs
pid Process 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe - JavaScript code in executable 42 IoCs
resource yara_rule behavioral1/files/0x00040000000130db-0.dat js behavioral1/files/0x00040000000130db-2.dat js behavioral1/files/0x00040000000130dc-3.dat js behavioral1/files/0x00050000000130df-6.dat js behavioral1/files/0x00050000000130df-8.dat js behavioral1/files/0x00040000000130dc-5.dat js behavioral1/files/0x00030000000130e0-9.dat js behavioral1/files/0x00030000000130e1-11.dat js behavioral1/files/0x00030000000130e0-13.dat js behavioral1/files/0x00030000000130e1-14.dat js behavioral1/files/0x00030000000130e2-15.dat js behavioral1/files/0x00030000000130e2-18.dat js behavioral1/files/0x00030000000130e3-17.dat js behavioral1/files/0x00030000000130e3-20.dat js behavioral1/files/0x00030000000130e4-21.dat js behavioral1/files/0x00030000000130e4-23.dat js behavioral1/files/0x00030000000130e5-26.dat js behavioral1/files/0x00030000000130e5-24.dat js behavioral1/files/0x00030000000130e6-27.dat js behavioral1/files/0x00030000000130e6-29.dat js behavioral1/files/0x00030000000130e7-30.dat js behavioral1/files/0x00030000000130e7-32.dat js behavioral1/files/0x00030000000130e8-33.dat js behavioral1/files/0x00030000000130e8-35.dat js behavioral1/files/0x00030000000130e9-36.dat js behavioral1/files/0x00030000000130e9-38.dat js behavioral1/files/0x00030000000130ea-39.dat js behavioral1/files/0x00030000000130eb-41.dat js behavioral1/files/0x00030000000130eb-44.dat js behavioral1/files/0x00030000000130ea-43.dat js behavioral1/files/0x00030000000130ec-45.dat js behavioral1/files/0x00030000000130ed-47.dat js behavioral1/files/0x00030000000130ed-49.dat js behavioral1/files/0x00030000000130ee-50.dat js behavioral1/files/0x00030000000130ef-53.dat js behavioral1/files/0x00030000000130ef-55.dat js behavioral1/files/0x00030000000130ec-52.dat js behavioral1/files/0x00030000000130f0-56.dat js behavioral1/files/0x00030000000130f1-60.dat js behavioral1/files/0x00030000000130ee-58.dat js behavioral1/files/0x00030000000130f1-62.dat js behavioral1/files/0x00030000000130f0-59.dat js - Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\oaAfhIr.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\ZELQPdo.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\pptvydt.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\lyOtAYM.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\vWhMRAY.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\KqfuaUS.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\OMXwlzB.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\AWkwWma.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\GJCDfYM.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\dbkHweR.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\ROuuBdi.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\qOxWqWe.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\EnwmnpN.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\OCPtKtu.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\fBXASTg.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\ESMNbGH.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\RRTCBNX.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\ujZoBGV.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\mMqpVnI.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\zcWCVMY.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe File created C:\Windows\System\ukuzShh.exe a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe Token: SeLockMemoryPrivilege 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 684 wrote to memory of 2012 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 27 PID 684 wrote to memory of 2012 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 27 PID 684 wrote to memory of 2012 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 27 PID 684 wrote to memory of 2016 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 28 PID 684 wrote to memory of 2016 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 28 PID 684 wrote to memory of 2016 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 28 PID 684 wrote to memory of 2040 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 29 PID 684 wrote to memory of 2040 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 29 PID 684 wrote to memory of 2040 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 29 PID 684 wrote to memory of 1172 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 30 PID 684 wrote to memory of 1172 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 30 PID 684 wrote to memory of 1172 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 30 PID 684 wrote to memory of 1980 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 31 PID 684 wrote to memory of 1980 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 31 PID 684 wrote to memory of 1980 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 31 PID 684 wrote to memory of 1816 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 32 PID 684 wrote to memory of 1816 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 32 PID 684 wrote to memory of 1816 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 32 PID 684 wrote to memory of 1752 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 33 PID 684 wrote to memory of 1752 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 33 PID 684 wrote to memory of 1752 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 33 PID 684 wrote to memory of 1796 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 34 PID 684 wrote to memory of 1796 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 34 PID 684 wrote to memory of 1796 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 34 PID 684 wrote to memory of 1732 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 35 PID 684 wrote to memory of 1732 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 35 PID 684 wrote to memory of 1732 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 35 PID 684 wrote to memory of 1340 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 36 PID 684 wrote to memory of 1340 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 36 PID 684 wrote to memory of 1340 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 36 PID 684 wrote to memory of 1112 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 37 PID 684 wrote to memory of 1112 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 37 PID 684 wrote to memory of 1112 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 37 PID 684 wrote to memory of 1104 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 38 PID 684 wrote to memory of 1104 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 38 PID 684 wrote to memory of 1104 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 38 PID 684 wrote to memory of 884 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 39 PID 684 wrote to memory of 884 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 39 PID 684 wrote to memory of 884 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 39 PID 684 wrote to memory of 1352 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 40 PID 684 wrote to memory of 1352 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 40 PID 684 wrote to memory of 1352 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 40 PID 684 wrote to memory of 1336 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 41 PID 684 wrote to memory of 1336 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 41 PID 684 wrote to memory of 1336 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 41 PID 684 wrote to memory of 568 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 42 PID 684 wrote to memory of 568 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 42 PID 684 wrote to memory of 568 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 42 PID 684 wrote to memory of 524 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 43 PID 684 wrote to memory of 524 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 43 PID 684 wrote to memory of 524 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 43 PID 684 wrote to memory of 1128 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 44 PID 684 wrote to memory of 1128 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 44 PID 684 wrote to memory of 1128 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 44 PID 684 wrote to memory of 1708 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 45 PID 684 wrote to memory of 1708 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 45 PID 684 wrote to memory of 1708 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 45 PID 684 wrote to memory of 276 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 46 PID 684 wrote to memory of 276 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 46 PID 684 wrote to memory of 276 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 46 PID 684 wrote to memory of 824 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 47 PID 684 wrote to memory of 824 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 47 PID 684 wrote to memory of 824 684 a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe"C:\Users\Admin\AppData\Local\Temp\a706fe832df8b57b3f94f6cc1b9f20d792e94f81b58e68224459b7a5afffc0e4.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\System\OMXwlzB.exeC:\Windows\System\OMXwlzB.exe2⤵
- Executes dropped EXE
PID:2012
-
-
C:\Windows\System\AWkwWma.exeC:\Windows\System\AWkwWma.exe2⤵
- Executes dropped EXE
PID:2016
-
-
C:\Windows\System\EnwmnpN.exeC:\Windows\System\EnwmnpN.exe2⤵
- Executes dropped EXE
PID:2040
-
-
C:\Windows\System\oaAfhIr.exeC:\Windows\System\oaAfhIr.exe2⤵
- Executes dropped EXE
PID:1172
-
-
C:\Windows\System\ZELQPdo.exeC:\Windows\System\ZELQPdo.exe2⤵
- Executes dropped EXE
PID:1980
-
-
C:\Windows\System\RRTCBNX.exeC:\Windows\System\RRTCBNX.exe2⤵
- Executes dropped EXE
PID:1816
-
-
C:\Windows\System\GJCDfYM.exeC:\Windows\System\GJCDfYM.exe2⤵
- Executes dropped EXE
PID:1752
-
-
C:\Windows\System\ujZoBGV.exeC:\Windows\System\ujZoBGV.exe2⤵
- Executes dropped EXE
PID:1796
-
-
C:\Windows\System\pptvydt.exeC:\Windows\System\pptvydt.exe2⤵
- Executes dropped EXE
PID:1732
-
-
C:\Windows\System\mMqpVnI.exeC:\Windows\System\mMqpVnI.exe2⤵
- Executes dropped EXE
PID:1340
-
-
C:\Windows\System\zcWCVMY.exeC:\Windows\System\zcWCVMY.exe2⤵
- Executes dropped EXE
PID:1112
-
-
C:\Windows\System\ukuzShh.exeC:\Windows\System\ukuzShh.exe2⤵
- Executes dropped EXE
PID:1104
-
-
C:\Windows\System\lyOtAYM.exeC:\Windows\System\lyOtAYM.exe2⤵
- Executes dropped EXE
PID:884
-
-
C:\Windows\System\dbkHweR.exeC:\Windows\System\dbkHweR.exe2⤵
- Executes dropped EXE
PID:1352
-
-
C:\Windows\System\OCPtKtu.exeC:\Windows\System\OCPtKtu.exe2⤵
- Executes dropped EXE
PID:1336
-
-
C:\Windows\System\ROuuBdi.exeC:\Windows\System\ROuuBdi.exe2⤵
- Executes dropped EXE
PID:568
-
-
C:\Windows\System\fBXASTg.exeC:\Windows\System\fBXASTg.exe2⤵
- Executes dropped EXE
PID:524
-
-
C:\Windows\System\vWhMRAY.exeC:\Windows\System\vWhMRAY.exe2⤵
- Executes dropped EXE
PID:1128
-
-
C:\Windows\System\qOxWqWe.exeC:\Windows\System\qOxWqWe.exe2⤵
- Executes dropped EXE
PID:1708
-
-
C:\Windows\System\KqfuaUS.exeC:\Windows\System\KqfuaUS.exe2⤵
- Executes dropped EXE
PID:276
-
-
C:\Windows\System\ESMNbGH.exeC:\Windows\System\ESMNbGH.exe2⤵
- Executes dropped EXE
PID:824
-