Analysis
- max time kernel
135s - max time network
140s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 16:55
Static task
static1
Behavioral task
behavioral1
Sample
document-1608522511.xlsb
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
document-1608522511.xlsb
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target document-1608522511.xlsb
- Size 291KB
- Sample201113-8bj994p7x2
- SHA256 55439eadb88dbd5e567e827f3787be4421068b97175d200d41b3ae6cad34ae6b
- MD5 1db69243cd93284bfb80a98d4e3f6cd7
- SHA1 1ab720847a6d3ef6d85918d364950338de63bdee
- SHA512 bd5411464307bb556b2302ba67c502e91a9f01dac106ad2d6c4e238134dbe02c4603086ce0ac2fa800c9f895a56ac35a2d96a988fb65561f048b561067b2b3fc
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 6 IoCs
pid Process 188 fwpxeohi.exe 3936 C922.exe 2800 C922.exe 2024 hibbsgs 2712 wpsekiu.exe 1128 wpsekiu.exe - Loads dropped DLL 1 IoCs
pid Process 188 fwpxeohi.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc wpsekiu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service wpsekiu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service wpsekiu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc C922.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 wpsekiu.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service C922.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service C922.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 wpsekiu.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc C922.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc wpsekiu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 C922.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 C922.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 648 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4004 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 1598 IoCs
pid Process 188 fwpxeohi.exe 188 fwpxeohi.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3936 C922.exe 3936 C922.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 2964 explorer.exe 2964 explorer.exe 1880 explorer.exe 1880 explorer.exe 2800 C922.exe 2800 C922.exe 3724 explorer.exe 3724 explorer.exe 1460 explorer.exe 1460 explorer.exe 4088 explorer.exe 4088 explorer.exe 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 2964 explorer.exe 2964 explorer.exe 1304 explorer.exe 1304 explorer.exe 2800 C922.exe 2800 C922.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 2964 explorer.exe 2964 explorer.exe 2964 explorer.exe 2964 explorer.exe 1032 explorer.exe 1032 explorer.exe 2712 wpsekiu.exe 2712 wpsekiu.exe 1304 explorer.exe 1304 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 3724 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 3724 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 3128 Process not Found 3128 Process not Found 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 1032 explorer.exe 1032 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 1032 explorer.exe 1032 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 1128 wpsekiu.exe 1128 wpsekiu.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1128 wpsekiu.exe 1128 wpsekiu.exe 1032 explorer.exe 1032 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 1008 explorer.exe 1008 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 1008 explorer.exe 1008 explorer.exe 1032 explorer.exe 1032 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 1304 explorer.exe 1304 explorer.exe 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 3128 Process not Found 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3724 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 1580 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3724 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 1580 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 3128 Process not Found 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3724 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3724 explorer.exe 948 explorer.exe 3724 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3724 explorer.exe 3724 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 1580 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3724 explorer.exe 948 explorer.exe 3724 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 1580 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 948 explorer.exe 1580 explorer.exe 948 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 948 explorer.exe 1580 explorer.exe 948 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3724 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 3128 Process not Found 4088 explorer.exe 3128 Process not Found 4088 explorer.exe 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 1580 explorer.exe 1580 explorer.exe 3128 Process not Found 948 explorer.exe 948 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3724 explorer.exe 948 explorer.exe 3724 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 3128 Process not Found 1032 explorer.exe 3128 Process not Found 3128 Process not Found 948 explorer.exe 1580 explorer.exe 948 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 1580 explorer.exe 1580 explorer.exe 3128 Process not Found 3724 explorer.exe 3724 explorer.exe 948 explorer.exe 948 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3724 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 1580 explorer.exe 1580 explorer.exe 3128 Process not Found 948 explorer.exe 948 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 948 explorer.exe 3724 explorer.exe 3724 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 948 explorer.exe 1580 explorer.exe 948 explorer.exe 1580 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3724 explorer.exe 3724 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 3724 explorer.exe 3128 Process not Found 3128 Process not Found 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3724 explorer.exe 3724 explorer.exe 948 explorer.exe 948 explorer.exe 1580 explorer.exe 1580 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1580 explorer.exe 1580 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 3724 explorer.exe 4088 explorer.exe 4088 explorer.exe 3128 Process not Found 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1032 explorer.exe 1032 explorer.exe 3128 Process not Found 3128 Process not Found 3724 explorer.exe 948 explorer.exe 948 explorer.exe 3724 explorer.exe 1580 explorer.exe 1580 explorer.exe 3128 Process not Found 4088 explorer.exe 3128 Process not Found 4088 explorer.exe 3128 Process not Found 1304 explorer.exe 1304 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 188 fwpxeohi.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 2712 wpsekiu.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE 4004 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3128 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 4004 wrote to memory of 188 4004 EXCEL.EXE 77 PID 4004 wrote to memory of 188 4004 EXCEL.EXE 77 PID 4004 wrote to memory of 188 4004 EXCEL.EXE 77 PID 3128 wrote to memory of 3936 3128 Process not Found 80 PID 3128 wrote to memory of 3936 3128 Process not Found 80 PID 3128 wrote to memory of 3936 3128 Process not Found 80 PID 3128 wrote to memory of 1528 3128 Process not Found 81 PID 3128 wrote to memory of 1528 3128 Process not Found 81 PID 3128 wrote to memory of 1528 3128 Process not Found 81 PID 3128 wrote to memory of 1528 3128 Process not Found 81 PID 3128 wrote to memory of 2020 3128 Process not Found 82 PID 3128 wrote to memory of 2020 3128 Process not Found 82 PID 3128 wrote to memory of 2020 3128 Process not Found 82 PID 3128 wrote to memory of 3976 3128 Process not Found 83 PID 3128 wrote to memory of 3976 3128 Process not Found 83 PID 3128 wrote to memory of 3976 3128 Process not Found 83 PID 3128 wrote to memory of 3976 3128 Process not Found 83 PID 3936 wrote to memory of 2800 3936 C922.exe 84 PID 3936 wrote to memory of 2800 3936 C922.exe 84 PID 3936 wrote to memory of 2800 3936 C922.exe 84 PID 3128 wrote to memory of 2964 3128 Process not Found 85 PID 3128 wrote to memory of 2964 3128 Process not Found 85 PID 3128 wrote to memory of 2964 3128 Process not Found 85 PID 3128 wrote to memory of 2964 3128 Process not Found 85 PID 3128 wrote to memory of 1880 3128 Process not Found 86 PID 3128 wrote to memory of 1880 3128 Process not Found 86 PID 3128 wrote to memory of 1880 3128 Process not Found 86 PID 3128 wrote to memory of 1880 3128 Process not Found 86 PID 3128 wrote to memory of 3724 3128 Process not Found 87 PID 3128 wrote to memory of 3724 3128 Process not Found 87 PID 3128 wrote to memory of 3724 3128 Process not Found 87 PID 3128 wrote to memory of 1460 3128 Process not Found 89 PID 3128 wrote to memory of 1460 3128 Process not Found 89 PID 3128 wrote to memory of 1460 3128 Process not Found 89 PID 3128 wrote to memory of 1460 3128 Process not Found 89 PID 3128 wrote to memory of 4088 3128 Process not Found 90 PID 3128 wrote to memory of 4088 3128 Process not Found 90 PID 3128 wrote to memory of 4088 3128 Process not Found 90 PID 3128 wrote to memory of 1032 3128 Process not Found 91 PID 3128 wrote to memory of 1032 3128 Process not Found 91 PID 3128 wrote to memory of 1032 3128 Process not Found 91 PID 3128 wrote to memory of 1032 3128 Process not Found 91 PID 3128 wrote to memory of 1304 3128 Process not Found 92 PID 3128 wrote to memory of 1304 3128 Process not Found 92 PID 3128 wrote to memory of 1304 3128 Process not Found 92 PID 3128 wrote to memory of 3120 3128 Process not Found 93 PID 3128 wrote to memory of 3120 3128 Process not Found 93 PID 3128 wrote to memory of 3120 3128 Process not Found 93 PID 3128 wrote to memory of 3120 3128 Process not Found 93 PID 3128 wrote to memory of 2772 3128 Process not Found 94 PID 3128 wrote to memory of 2772 3128 Process not Found 94 PID 3128 wrote to memory of 2772 3128 Process not Found 94 PID 3128 wrote to memory of 2772 3128 Process not Found 94 PID 3128 wrote to memory of 948 3128 Process not Found 95 PID 3128 wrote to memory of 948 3128 Process not Found 95 PID 3128 wrote to memory of 948 3128 Process not Found 95 PID 3128 wrote to memory of 948 3128 Process not Found 95 PID 3128 wrote to memory of 1580 3128 Process not Found 96 PID 3128 wrote to memory of 1580 3128 Process not Found 96 PID 3128 wrote to memory of 1580 3128 Process not Found 96 PID 3128 wrote to memory of 2936 3128 Process not Found 97 PID 3128 wrote to memory of 2936 3128 Process not Found 97 PID 3128 wrote to memory of 2936 3128 Process not Found 97 PID 3128 wrote to memory of 2936 3128 Process not Found 97 PID 3936 wrote to memory of 2712 3936 C922.exe 98 PID 3936 wrote to memory of 2712 3936 C922.exe 98 PID 3936 wrote to memory of 2712 3936 C922.exe 98 PID 3936 wrote to memory of 648 3936 C922.exe 99 PID 3936 wrote to memory of 648 3936 C922.exe 99 PID 3936 wrote to memory of 648 3936 C922.exe 99 PID 2712 wrote to memory of 1128 2712 wpsekiu.exe 101 PID 2712 wrote to memory of 1128 2712 wpsekiu.exe 101 PID 2712 wrote to memory of 1128 2712 wpsekiu.exe 101 PID 2712 wrote to memory of 1008 2712 wpsekiu.exe 102 PID 2712 wrote to memory of 1008 2712 wpsekiu.exe 102 PID 2712 wrote to memory of 1008 2712 wpsekiu.exe 102 PID 2712 wrote to memory of 1008 2712 wpsekiu.exe 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1608522511.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:188
-
-
C:\Users\Admin\AppData\Local\Temp\C922.exeC:\Users\Admin\AppData\Local\Temp\C922.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\C922.exeC:\Users\Admin\AppData\Local\Temp\C922.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2800
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Quoatiseqmig\wpsekiu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Quoatiseqmig\wpsekiu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:2712 -
C:\Users\Admin\AppData\Roaming\Microsoft\Quoatiseqmig\wpsekiu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Quoatiseqmig\wpsekiu.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1128
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:1008
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn syyksmqewt /tr "\"C:\Users\Admin\AppData\Local\Temp\C922.exe\" /I syyksmqewt" /SC ONCE /Z /ST 17:02 /ET 17:142⤵
- Creates scheduled task(s)
PID:648
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1528
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2020
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3976
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2964
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1880
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3724
-
C:\Users\Admin\AppData\Roaming\hibbsgsC:\Users\Admin\AppData\Roaming\hibbsgs1⤵
- Executes dropped EXE
PID:2024
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1460
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4088
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1032
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1304
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3120
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2772
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:948
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1580
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2936