Analysis
- max time kernel
125s - max time network
133s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe
- Size 5.9MB
- Sample201110-x3bpfesfss
- SHA256 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1
- MD5 8396625a33fe3716e1ebabc070197e33
- SHA1 e141cec418a29e5bb8700733e683cd4a074350cc
- SHA512 3bafc1787c7b65a87bb7cff6a9044568bde83e0c94bc90c93b011bde0d048a0dc92fae5c8b5dd0895a389f07b2636e3959a09beb2445530b1a0ff319642e4d5d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Cobalt Strike reflective loader 42 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x00040000000130dd-0.dat cobalt_reflective_dll behavioral1/files/0x00040000000130dd-2.dat cobalt_reflective_dll behavioral1/files/0x00040000000130de-3.dat cobalt_reflective_dll behavioral1/files/0x00040000000130de-5.dat cobalt_reflective_dll behavioral1/files/0x00050000000130e1-6.dat cobalt_reflective_dll behavioral1/files/0x00050000000130e1-8.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e2-9.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e2-11.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e3-12.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e3-14.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e4-17.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e4-15.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e5-18.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e6-21.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e6-23.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e5-20.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e7-24.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e7-26.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e8-27.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e8-31.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e9-29.dat cobalt_reflective_dll behavioral1/files/0x00030000000130e9-32.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ea-33.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ea-35.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ec-36.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ed-39.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ec-38.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ed-43.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ee-41.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ef-45.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ee-44.dat cobalt_reflective_dll behavioral1/files/0x00030000000130ef-47.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f0-48.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f1-50.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f1-52.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f0-55.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f2-53.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f3-56.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f3-58.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f2-59.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f4-60.dat cobalt_reflective_dll behavioral1/files/0x00030000000130f4-62.dat cobalt_reflective_dll - Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Executes dropped EXE 21 IoCs
pid Process 1964 YcJNBAA.exe 1916 CwEuLgy.exe 1720 eWuOeHE.exe 1804 GskkfYN.exe 1312 tfEtYHr.exe 824 UwPoNCA.exe 1552 xqqVXsY.exe 1528 JZAoYmW.exe 756 FbzyZZw.exe 576 oGpeNnw.exe 788 MJiHRXR.exe 1496 EtSjUlA.exe 552 BoRUYMw.exe 936 lxlSpjE.exe 1192 GFujGeu.exe 656 NTdXzSe.exe 1304 wjAguqW.exe 688 HIGNVAI.exe 920 QWhIBgH.exe 1612 TWvAqoj.exe 1596 DNSsUSG.exe -
resource yara_rule behavioral1/files/0x00040000000130dd-0.dat upx behavioral1/files/0x00040000000130dd-2.dat upx behavioral1/files/0x00040000000130de-3.dat upx behavioral1/files/0x00040000000130de-5.dat upx behavioral1/files/0x00050000000130e1-6.dat upx behavioral1/files/0x00050000000130e1-8.dat upx behavioral1/files/0x00030000000130e2-9.dat upx behavioral1/files/0x00030000000130e2-11.dat upx behavioral1/files/0x00030000000130e3-12.dat upx behavioral1/files/0x00030000000130e3-14.dat upx behavioral1/files/0x00030000000130e4-17.dat upx behavioral1/files/0x00030000000130e4-15.dat upx behavioral1/files/0x00030000000130e5-18.dat upx behavioral1/files/0x00030000000130e6-21.dat upx behavioral1/files/0x00030000000130e6-23.dat upx behavioral1/files/0x00030000000130e5-20.dat upx behavioral1/files/0x00030000000130e7-24.dat upx behavioral1/files/0x00030000000130e7-26.dat upx behavioral1/files/0x00030000000130e8-27.dat upx behavioral1/files/0x00030000000130e8-31.dat upx behavioral1/files/0x00030000000130e9-29.dat upx behavioral1/files/0x00030000000130e9-32.dat upx behavioral1/files/0x00030000000130ea-33.dat upx behavioral1/files/0x00030000000130ea-35.dat upx behavioral1/files/0x00030000000130ec-36.dat upx behavioral1/files/0x00030000000130ed-39.dat upx behavioral1/files/0x00030000000130ec-38.dat upx behavioral1/files/0x00030000000130ed-43.dat upx behavioral1/files/0x00030000000130ee-41.dat upx behavioral1/files/0x00030000000130ef-45.dat upx behavioral1/files/0x00030000000130ee-44.dat upx behavioral1/files/0x00030000000130ef-47.dat upx behavioral1/files/0x00030000000130f0-48.dat upx behavioral1/files/0x00030000000130f1-50.dat upx behavioral1/files/0x00030000000130f1-52.dat upx behavioral1/files/0x00030000000130f0-55.dat upx behavioral1/files/0x00030000000130f2-53.dat upx behavioral1/files/0x00030000000130f3-56.dat upx behavioral1/files/0x00030000000130f3-58.dat upx behavioral1/files/0x00030000000130f2-59.dat upx behavioral1/files/0x00030000000130f4-60.dat upx behavioral1/files/0x00030000000130f4-62.dat upx - Loads dropped DLL 21 IoCs
pid Process 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe - JavaScript code in executable 42 IoCs
resource yara_rule behavioral1/files/0x00040000000130dd-0.dat js behavioral1/files/0x00040000000130dd-2.dat js behavioral1/files/0x00040000000130de-3.dat js behavioral1/files/0x00040000000130de-5.dat js behavioral1/files/0x00050000000130e1-6.dat js behavioral1/files/0x00050000000130e1-8.dat js behavioral1/files/0x00030000000130e2-9.dat js behavioral1/files/0x00030000000130e2-11.dat js behavioral1/files/0x00030000000130e3-12.dat js behavioral1/files/0x00030000000130e3-14.dat js behavioral1/files/0x00030000000130e4-17.dat js behavioral1/files/0x00030000000130e4-15.dat js behavioral1/files/0x00030000000130e5-18.dat js behavioral1/files/0x00030000000130e6-21.dat js behavioral1/files/0x00030000000130e6-23.dat js behavioral1/files/0x00030000000130e5-20.dat js behavioral1/files/0x00030000000130e7-24.dat js behavioral1/files/0x00030000000130e7-26.dat js behavioral1/files/0x00030000000130e8-27.dat js behavioral1/files/0x00030000000130e8-31.dat js behavioral1/files/0x00030000000130e9-29.dat js behavioral1/files/0x00030000000130e9-32.dat js behavioral1/files/0x00030000000130ea-33.dat js behavioral1/files/0x00030000000130ea-35.dat js behavioral1/files/0x00030000000130ec-36.dat js behavioral1/files/0x00030000000130ed-39.dat js behavioral1/files/0x00030000000130ec-38.dat js behavioral1/files/0x00030000000130ed-43.dat js behavioral1/files/0x00030000000130ee-41.dat js behavioral1/files/0x00030000000130ef-45.dat js behavioral1/files/0x00030000000130ee-44.dat js behavioral1/files/0x00030000000130ef-47.dat js behavioral1/files/0x00030000000130f0-48.dat js behavioral1/files/0x00030000000130f1-50.dat js behavioral1/files/0x00030000000130f1-52.dat js behavioral1/files/0x00030000000130f0-55.dat js behavioral1/files/0x00030000000130f2-53.dat js behavioral1/files/0x00030000000130f3-56.dat js behavioral1/files/0x00030000000130f3-58.dat js behavioral1/files/0x00030000000130f2-59.dat js behavioral1/files/0x00030000000130f4-60.dat js behavioral1/files/0x00030000000130f4-62.dat js - Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\GskkfYN.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\JZAoYmW.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\EtSjUlA.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\NTdXzSe.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\wjAguqW.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\DNSsUSG.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\CwEuLgy.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\UwPoNCA.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\oGpeNnw.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\MJiHRXR.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\eWuOeHE.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\BoRUYMw.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\lxlSpjE.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\TWvAqoj.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\GFujGeu.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\HIGNVAI.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\QWhIBgH.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\YcJNBAA.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\tfEtYHr.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\xqqVXsY.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe File created C:\Windows\System\FbzyZZw.exe eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe Token: SeLockMemoryPrivilege 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 740 wrote to memory of 1964 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 29 PID 740 wrote to memory of 1964 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 29 PID 740 wrote to memory of 1964 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 29 PID 740 wrote to memory of 1916 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 30 PID 740 wrote to memory of 1916 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 30 PID 740 wrote to memory of 1916 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 30 PID 740 wrote to memory of 1720 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 31 PID 740 wrote to memory of 1720 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 31 PID 740 wrote to memory of 1720 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 31 PID 740 wrote to memory of 1804 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 32 PID 740 wrote to memory of 1804 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 32 PID 740 wrote to memory of 1804 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 32 PID 740 wrote to memory of 1312 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 33 PID 740 wrote to memory of 1312 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 33 PID 740 wrote to memory of 1312 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 33 PID 740 wrote to memory of 824 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 35 PID 740 wrote to memory of 824 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 35 PID 740 wrote to memory of 824 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 35 PID 740 wrote to memory of 1552 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 36 PID 740 wrote to memory of 1552 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 36 PID 740 wrote to memory of 1552 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 36 PID 740 wrote to memory of 1528 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 37 PID 740 wrote to memory of 1528 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 37 PID 740 wrote to memory of 1528 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 37 PID 740 wrote to memory of 756 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 38 PID 740 wrote to memory of 756 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 38 PID 740 wrote to memory of 756 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 38 PID 740 wrote to memory of 576 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 39 PID 740 wrote to memory of 576 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 39 PID 740 wrote to memory of 576 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 39 PID 740 wrote to memory of 788 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 40 PID 740 wrote to memory of 788 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 40 PID 740 wrote to memory of 788 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 40 PID 740 wrote to memory of 1496 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 41 PID 740 wrote to memory of 1496 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 41 PID 740 wrote to memory of 1496 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 41 PID 740 wrote to memory of 552 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 42 PID 740 wrote to memory of 552 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 42 PID 740 wrote to memory of 552 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 42 PID 740 wrote to memory of 936 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 43 PID 740 wrote to memory of 936 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 43 PID 740 wrote to memory of 936 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 43 PID 740 wrote to memory of 1192 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 44 PID 740 wrote to memory of 1192 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 44 PID 740 wrote to memory of 1192 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 44 PID 740 wrote to memory of 656 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 45 PID 740 wrote to memory of 656 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 45 PID 740 wrote to memory of 656 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 45 PID 740 wrote to memory of 688 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 46 PID 740 wrote to memory of 688 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 46 PID 740 wrote to memory of 688 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 46 PID 740 wrote to memory of 1304 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 47 PID 740 wrote to memory of 1304 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 47 PID 740 wrote to memory of 1304 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 47 PID 740 wrote to memory of 1612 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 48 PID 740 wrote to memory of 1612 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 48 PID 740 wrote to memory of 1612 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 48 PID 740 wrote to memory of 920 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 49 PID 740 wrote to memory of 920 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 49 PID 740 wrote to memory of 920 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 49 PID 740 wrote to memory of 1596 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 50 PID 740 wrote to memory of 1596 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 50 PID 740 wrote to memory of 1596 740 eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe"C:\Users\Admin\AppData\Local\Temp\eb5c2b35fe22ebceaaf361677c097440da69f522a2c8cb9bb9df9708c0c822a1.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\System\YcJNBAA.exeC:\Windows\System\YcJNBAA.exe2⤵
- Executes dropped EXE
PID:1964
-
-
C:\Windows\System\CwEuLgy.exeC:\Windows\System\CwEuLgy.exe2⤵
- Executes dropped EXE
PID:1916
-
-
C:\Windows\System\eWuOeHE.exeC:\Windows\System\eWuOeHE.exe2⤵
- Executes dropped EXE
PID:1720
-
-
C:\Windows\System\GskkfYN.exeC:\Windows\System\GskkfYN.exe2⤵
- Executes dropped EXE
PID:1804
-
-
C:\Windows\System\tfEtYHr.exeC:\Windows\System\tfEtYHr.exe2⤵
- Executes dropped EXE
PID:1312
-
-
C:\Windows\System\UwPoNCA.exeC:\Windows\System\UwPoNCA.exe2⤵
- Executes dropped EXE
PID:824
-
-
C:\Windows\System\xqqVXsY.exeC:\Windows\System\xqqVXsY.exe2⤵
- Executes dropped EXE
PID:1552
-
-
C:\Windows\System\JZAoYmW.exeC:\Windows\System\JZAoYmW.exe2⤵
- Executes dropped EXE
PID:1528
-
-
C:\Windows\System\FbzyZZw.exeC:\Windows\System\FbzyZZw.exe2⤵
- Executes dropped EXE
PID:756
-
-
C:\Windows\System\oGpeNnw.exeC:\Windows\System\oGpeNnw.exe2⤵
- Executes dropped EXE
PID:576
-
-
C:\Windows\System\MJiHRXR.exeC:\Windows\System\MJiHRXR.exe2⤵
- Executes dropped EXE
PID:788
-
-
C:\Windows\System\EtSjUlA.exeC:\Windows\System\EtSjUlA.exe2⤵
- Executes dropped EXE
PID:1496
-
-
C:\Windows\System\BoRUYMw.exeC:\Windows\System\BoRUYMw.exe2⤵
- Executes dropped EXE
PID:552
-
-
C:\Windows\System\lxlSpjE.exeC:\Windows\System\lxlSpjE.exe2⤵
- Executes dropped EXE
PID:936
-
-
C:\Windows\System\GFujGeu.exeC:\Windows\System\GFujGeu.exe2⤵
- Executes dropped EXE
PID:1192
-
-
C:\Windows\System\NTdXzSe.exeC:\Windows\System\NTdXzSe.exe2⤵
- Executes dropped EXE
PID:656
-
-
C:\Windows\System\HIGNVAI.exeC:\Windows\System\HIGNVAI.exe2⤵
- Executes dropped EXE
PID:688
-
-
C:\Windows\System\wjAguqW.exeC:\Windows\System\wjAguqW.exe2⤵
- Executes dropped EXE
PID:1304
-
-
C:\Windows\System\TWvAqoj.exeC:\Windows\System\TWvAqoj.exe2⤵
- Executes dropped EXE
PID:1612
-
-
C:\Windows\System\QWhIBgH.exeC:\Windows\System\QWhIBgH.exe2⤵
- Executes dropped EXE
PID:920
-
-
C:\Windows\System\DNSsUSG.exeC:\Windows\System\DNSsUSG.exe2⤵
- Executes dropped EXE
PID:1596
-