Analysis
- max time kernel
151s - max time network
121s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/12/2020, 18:39
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target file.exe
- Size 317KB
- Sample201208-5e1x2bcxes
- SHA256 a9d54a962d46e4a2d40da284aa8b3a25a3b4e93b7c388890cd38b838a1a65433
- MD5 6c1f8b04da7ac6bb394cf07c4d3b731a
- SHA1 7b6aff6f3181b5e3ff902e2b0894935b4db29269
- SHA512 0509e2346a081694095e09970677737303d04cde5180af8d8425d9c8d0151bf0d7f44cd1399f3f6ee05ccbca0c5ba683297902ee47ea4e673c43937e51cd0a5d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://thirdgearback.net/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 2968 Process not Found - Loads dropped DLL 1 IoCs
pid Process 728 file.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 1514 IoCs
pid Process 728 file.exe 728 file.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2212 explorer.exe 2212 explorer.exe 2968 Process not Found 2968 Process not Found 2212 explorer.exe 2212 explorer.exe 2968 Process not Found 2968 Process not Found 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2708 explorer.exe 2708 explorer.exe 1020 explorer.exe 1020 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 1020 explorer.exe 1020 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 1020 explorer.exe 1020 explorer.exe 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 1020 explorer.exe 1020 explorer.exe 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 1020 explorer.exe 1020 explorer.exe 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 2968 Process not Found 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 2968 Process not Found 2968 Process not Found 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1096 explorer.exe 1096 explorer.exe 3548 explorer.exe 2968 Process not Found 3548 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1020 explorer.exe 1020 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found - Suspicious behavior: MapViewOfSection 15 IoCs
pid Process 728 file.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2968 Process not Found - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2212 2968 Process not Found 78 PID 2968 wrote to memory of 2212 2968 Process not Found 78 PID 2968 wrote to memory of 2212 2968 Process not Found 78 PID 2968 wrote to memory of 2212 2968 Process not Found 78 PID 2968 wrote to memory of 1096 2968 Process not Found 79 PID 2968 wrote to memory of 1096 2968 Process not Found 79 PID 2968 wrote to memory of 1096 2968 Process not Found 79 PID 2968 wrote to memory of 1096 2968 Process not Found 79 PID 2968 wrote to memory of 2708 2968 Process not Found 80 PID 2968 wrote to memory of 2708 2968 Process not Found 80 PID 2968 wrote to memory of 2708 2968 Process not Found 80 PID 2968 wrote to memory of 1020 2968 Process not Found 81 PID 2968 wrote to memory of 1020 2968 Process not Found 81 PID 2968 wrote to memory of 1020 2968 Process not Found 81 PID 2968 wrote to memory of 1020 2968 Process not Found 81 PID 2968 wrote to memory of 3548 2968 Process not Found 82 PID 2968 wrote to memory of 3548 2968 Process not Found 82 PID 2968 wrote to memory of 3548 2968 Process not Found 82 PID 2968 wrote to memory of 2676 2968 Process not Found 83 PID 2968 wrote to memory of 2676 2968 Process not Found 83 PID 2968 wrote to memory of 2676 2968 Process not Found 83 PID 2968 wrote to memory of 2676 2968 Process not Found 83 PID 2968 wrote to memory of 848 2968 Process not Found 84 PID 2968 wrote to memory of 848 2968 Process not Found 84 PID 2968 wrote to memory of 848 2968 Process not Found 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:728
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2212
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1096
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2708
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1020
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3548
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2676
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:848