Analysis
-
max time kernel
130s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-10-2021 13:24
Static task
static1
Behavioral task
behavioral1
Sample
53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe
Resource
win10v20210408
General
-
Target
53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe
-
Size
455KB
-
MD5
a970b0c0fee23738223da299caafc800
-
SHA1
eeffbde95c891a437ecf025a4079eff3f5b67210
-
SHA256
53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4
-
SHA512
be05a5034217fa057ccf553887e72c0db1df71425501f5381c2a7b856c12230aab546d8e61a7063cb750ff964061e97f38529d5d8c20b18b0a5bbaaad33bb3cf
Malware Config
Signatures
-
Detect Neshta Payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/4052-126-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/4052-127-0x00000000004080E4-mapping.dmp family_neshta behavioral1/memory/4052-129-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta behavioral1/memory/1644-144-0x00000000052F0000-0x00000000057EE000-memory.dmp family_neshta behavioral1/memory/2388-148-0x00000000004080E4-mapping.dmp family_neshta C:\Windows\svchost.com family_neshta behavioral1/memory/3288-163-0x0000000004F80000-0x000000000547E000-memory.dmp family_neshta behavioral1/memory/1304-167-0x00000000004080E4-mapping.dmp family_neshta C:\Windows\svchost.com family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 11 IoCs
Processes:
53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exesvchost.com53125B~1.EXE53125B~1.EXE53125B~1.EXEsvchost.com53125B~1.EXE53125B~1.EXEsvchost.com53125B~1.EXEpid process 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 4052 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 1724 svchost.com 1644 53125B~1.EXE 2016 53125B~1.EXE 2388 53125B~1.EXE 3204 svchost.com 3288 53125B~1.EXE 1304 53125B~1.EXE 2432 svchost.com 3636 53125B~1.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe53125B~1.EXE53125B~1.EXEdescription pid process target process PID 3912 set thread context of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 1644 set thread context of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 3288 set thread context of 1304 3288 53125B~1.EXE 53125B~1.EXE -
Drops file in Program Files directory 55 IoCs
Processes:
53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exedescription ioc process File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Google\Temp\GUM18A1.tmp\GOFB2B~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe -
Drops file in Windows directory 12 IoCs
Processes:
53125B~1.EXEsvchost.com53125B~1.EXEsvchost.comsvchost.com53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exedescription ioc process File opened for modification C:\Windows\svchost.com 53125B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 53125B~1.EXE File opened for modification C:\Windows\directx.sys 53125B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\Windows\directx.sys 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\Windows\svchost.com 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe File opened for modification C:\Windows\directx.sys 53125B~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 4 IoCs
Processes:
53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe53125B~1.EXE53125B~1.EXE53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings 53125B~1.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings 53125B~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
53125B~1.EXEpid process 1644 53125B~1.EXE 1644 53125B~1.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
53125B~1.EXEdescription pid process Token: SeDebugPrivilege 1644 53125B~1.EXE -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exesvchost.com53125B~1.EXE53125B~1.EXEsvchost.com53125B~1.EXE53125B~1.EXEsvchost.comdescription pid process target process PID 4000 wrote to memory of 3912 4000 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 4000 wrote to memory of 3912 4000 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 4000 wrote to memory of 3912 4000 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 3912 wrote to memory of 4052 3912 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe PID 4052 wrote to memory of 1724 4052 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe svchost.com PID 4052 wrote to memory of 1724 4052 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe svchost.com PID 4052 wrote to memory of 1724 4052 53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe svchost.com PID 1724 wrote to memory of 1644 1724 svchost.com 53125B~1.EXE PID 1724 wrote to memory of 1644 1724 svchost.com 53125B~1.EXE PID 1724 wrote to memory of 1644 1724 svchost.com 53125B~1.EXE PID 1644 wrote to memory of 2016 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2016 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2016 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 1644 wrote to memory of 2388 1644 53125B~1.EXE 53125B~1.EXE PID 2388 wrote to memory of 3204 2388 53125B~1.EXE svchost.com PID 2388 wrote to memory of 3204 2388 53125B~1.EXE svchost.com PID 2388 wrote to memory of 3204 2388 53125B~1.EXE svchost.com PID 3204 wrote to memory of 3288 3204 svchost.com 53125B~1.EXE PID 3204 wrote to memory of 3288 3204 svchost.com 53125B~1.EXE PID 3204 wrote to memory of 3288 3204 svchost.com 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 3288 wrote to memory of 1304 3288 53125B~1.EXE 53125B~1.EXE PID 1304 wrote to memory of 2432 1304 53125B~1.EXE svchost.com PID 1304 wrote to memory of 2432 1304 53125B~1.EXE svchost.com PID 1304 wrote to memory of 2432 1304 53125B~1.EXE svchost.com PID 2432 wrote to memory of 3636 2432 svchost.com 53125B~1.EXE PID 2432 wrote to memory of 3636 2432 svchost.com 53125B~1.EXE PID 2432 wrote to memory of 3636 2432 svchost.com 53125B~1.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe"C:\Users\Admin\AppData\Local\Temp\53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE"C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE"6⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE"C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE"6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE"C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE"10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXE11⤵
- Executes dropped EXE
PID:3636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\53125B~1.EXE.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXEMD5
fbc1ed64be96f47d5cc3fbcb21cce10f
SHA1a2c3c2aa059f835a54f26aa385153690afc3510a
SHA2560fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5
SHA51258a8c2e86ac0b2c180efbc66c2a2069677c2efbf28fe3578cdb03d6fa6396ab6cd54f50c0bde23ff8d045aebb4306ee3be853930511bd2e8dadfe028fa98b62b
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXEMD5
fbc1ed64be96f47d5cc3fbcb21cce10f
SHA1a2c3c2aa059f835a54f26aa385153690afc3510a
SHA2560fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5
SHA51258a8c2e86ac0b2c180efbc66c2a2069677c2efbf28fe3578cdb03d6fa6396ab6cd54f50c0bde23ff8d045aebb4306ee3be853930511bd2e8dadfe028fa98b62b
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXEMD5
fbc1ed64be96f47d5cc3fbcb21cce10f
SHA1a2c3c2aa059f835a54f26aa385153690afc3510a
SHA2560fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5
SHA51258a8c2e86ac0b2c180efbc66c2a2069677c2efbf28fe3578cdb03d6fa6396ab6cd54f50c0bde23ff8d045aebb4306ee3be853930511bd2e8dadfe028fa98b62b
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXEMD5
fbc1ed64be96f47d5cc3fbcb21cce10f
SHA1a2c3c2aa059f835a54f26aa385153690afc3510a
SHA2560fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5
SHA51258a8c2e86ac0b2c180efbc66c2a2069677c2efbf28fe3578cdb03d6fa6396ab6cd54f50c0bde23ff8d045aebb4306ee3be853930511bd2e8dadfe028fa98b62b
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXEMD5
fbc1ed64be96f47d5cc3fbcb21cce10f
SHA1a2c3c2aa059f835a54f26aa385153690afc3510a
SHA2560fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5
SHA51258a8c2e86ac0b2c180efbc66c2a2069677c2efbf28fe3578cdb03d6fa6396ab6cd54f50c0bde23ff8d045aebb4306ee3be853930511bd2e8dadfe028fa98b62b
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53125B~1.EXEMD5
fbc1ed64be96f47d5cc3fbcb21cce10f
SHA1a2c3c2aa059f835a54f26aa385153690afc3510a
SHA2560fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5
SHA51258a8c2e86ac0b2c180efbc66c2a2069677c2efbf28fe3578cdb03d6fa6396ab6cd54f50c0bde23ff8d045aebb4306ee3be853930511bd2e8dadfe028fa98b62b
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exeMD5
fbc1ed64be96f47d5cc3fbcb21cce10f
SHA1a2c3c2aa059f835a54f26aa385153690afc3510a
SHA2560fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5
SHA51258a8c2e86ac0b2c180efbc66c2a2069677c2efbf28fe3578cdb03d6fa6396ab6cd54f50c0bde23ff8d045aebb4306ee3be853930511bd2e8dadfe028fa98b62b
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exeMD5
fbc1ed64be96f47d5cc3fbcb21cce10f
SHA1a2c3c2aa059f835a54f26aa385153690afc3510a
SHA2560fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5
SHA51258a8c2e86ac0b2c180efbc66c2a2069677c2efbf28fe3578cdb03d6fa6396ab6cd54f50c0bde23ff8d045aebb4306ee3be853930511bd2e8dadfe028fa98b62b
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53125b8ade45028207dd476148af9011bb4db4aa4c6427ed8fa1d14f90bab2c4.exeMD5
fbc1ed64be96f47d5cc3fbcb21cce10f
SHA1a2c3c2aa059f835a54f26aa385153690afc3510a
SHA2560fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5
SHA51258a8c2e86ac0b2c180efbc66c2a2069677c2efbf28fe3578cdb03d6fa6396ab6cd54f50c0bde23ff8d045aebb4306ee3be853930511bd2e8dadfe028fa98b62b
-
C:\Users\Admin\AppData\Local\Temp\tmp5023.tmpMD5
b5a40c924867fdeee213c475eaad6c27
SHA10f40224fd97273e3783ca6b48b3b5a34e3f9d4f7
SHA25652179420774cacd7a13e6692748491fa9c39be8ef8f05f5bdc2ae0757af0e455
SHA5128d580a832a6fcd1dd417fa7a723bdedb2c0b39d011083fbb9a49a37439cfcdd4eb409ef04faaca9feebd13be676c9b5d4a8956a1e860cd18fa5433c1071b9ea2
-
C:\Windows\directx.sysMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\directx.sysMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\directx.sysMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\directx.sysMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\directx.sysMD5
3e1e14870e99a57257c13aaf67c3289e
SHA1fc69ce8b6c053c7d33b1f3d5f7027899becc92e2
SHA256ad288782f0643a05d6fbc35e7bb154d09bd15817cc77e302bf8f7b9549ad448a
SHA51226eb0a99d3cf444efd8f27894cc416d6a0d97d7757b13f4c91b8d8a8148322ade0d9a2d2fb9e635240eb163f42df495753fd22f1f0a6e7ab38dd38a29aae397d
-
C:\Windows\svchost.comMD5
36fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
C:\Windows\svchost.comMD5
36fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
C:\Windows\svchost.comMD5
36fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
C:\Windows\svchost.comMD5
36fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
memory/1304-167-0x00000000004080E4-mapping.dmp
-
memory/1644-133-0x0000000000000000-mapping.dmp
-
memory/1644-144-0x00000000052F0000-0x00000000057EE000-memory.dmpFilesize
5.0MB
-
memory/1724-130-0x0000000000000000-mapping.dmp
-
memory/2388-148-0x00000000004080E4-mapping.dmp
-
memory/2432-169-0x0000000000000000-mapping.dmp
-
memory/3204-150-0x0000000000000000-mapping.dmp
-
memory/3288-154-0x0000000000000000-mapping.dmp
-
memory/3288-163-0x0000000004F80000-0x000000000547E000-memory.dmpFilesize
5.0MB
-
memory/3636-181-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB
-
memory/3636-173-0x0000000000000000-mapping.dmp
-
memory/3912-119-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/3912-120-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/3912-124-0x0000000004CE0000-0x0000000004CEA000-memory.dmpFilesize
40KB
-
memory/3912-117-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/3912-123-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/3912-125-0x0000000005A30000-0x0000000005A86000-memory.dmpFilesize
344KB
-
memory/3912-114-0x0000000000000000-mapping.dmp
-
memory/3912-121-0x0000000004BD0000-0x00000000050CE000-memory.dmpFilesize
5.0MB
-
memory/3912-122-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/4052-126-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4052-129-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4052-127-0x00000000004080E4-mapping.dmp