neshta | 16f75019c7de5d79c259d4b1f1003938bd6449ce3c49b28d6320bb43dd6bd82a

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-en-20211014
submitted
31-10-2021 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

931568b982ac42dd2edc68ff203ec101.exe
Size

275KB
MD5

931568b982ac42dd2edc68ff203ec101
SHA1

9955f4d4fd6e0000a908e99116d5d22c6371b255
SHA256

16f75019c7de5d79c259d4b1f1003938bd6449ce3c49b28d6320bb43dd6bd82a
SHA512

2f9fd405e6d6dbcc369108d325ee195bac392beea240ce12c16d05bec9295240d971f9d87427a2664aed559564ed415489c0e3f9493184bac8fef824c9243780

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

931568b982ac42dd2edc68ff203ec101.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	931568b982ac42dd2edc68ff203ec101.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 2 IoCs

Processes:

931568b982ac42dd2edc68ff203ec101.exe931568b982ac42dd2edc68ff203ec101.exe

pid process

796 931568b982ac42dd2edc68ff203ec101.exe
1424 931568b982ac42dd2edc68ff203ec101.exe

pid	process
796	931568b982ac42dd2edc68ff203ec101.exe
1424	931568b982ac42dd2edc68ff203ec101.exe

Loads dropped DLL 7 IoCs

Processes:

931568b982ac42dd2edc68ff203ec101.exe931568b982ac42dd2edc68ff203ec101.exeWerFault.exe

pid	process
1648	931568b982ac42dd2edc68ff203ec101.exe
796	931568b982ac42dd2edc68ff203ec101.exe
796	931568b982ac42dd2edc68ff203ec101.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
1648	931568b982ac42dd2edc68ff203ec101.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

931568b982ac42dd2edc68ff203ec101.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	931568b982ac42dd2edc68ff203ec101.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	931568b982ac42dd2edc68ff203ec101.exe

Drops file in Windows directory 1 IoCs

Processes:

931568b982ac42dd2edc68ff203ec101.exe

description ioc process

File opened for modification C:\Windows\svchost.com 931568b982ac42dd2edc68ff203ec101.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

360 1424 WerFault.exe 931568b982ac42dd2edc68ff203ec101.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	931568b982ac42dd2edc68ff203ec101.exe

pid	pid_target	process	target process
360	1424	WerFault.exe	931568b982ac42dd2edc68ff203ec101.exe

NSIS installer 16 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe	nsis_installer_2

Modifies registry class 1 IoCs

Processes:

931568b982ac42dd2edc68ff203ec101.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	931568b982ac42dd2edc68ff203ec101.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

360 WerFault.exe
360 WerFault.exe
360 WerFault.exe
360 WerFault.exe
360 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

360 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 360 WerFault.exe

pid	process
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe

pid	process
360	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	360	WerFault.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

931568b982ac42dd2edc68ff203ec101.exe931568b982ac42dd2edc68ff203ec101.exe931568b982ac42dd2edc68ff203ec101.exe

C:\Users\Admin\AppData\Local\Temp\931568b982ac42dd2edc68ff203ec101.exe
"C:\Users\Admin\AppData\Local\Temp\931568b982ac42dd2edc68ff203ec101.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:796

C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 148
4⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:360

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe
MD5
8d97ea0aeb6dbb5bfe61a2a45809dd90

SHA1
c2abdfefadc76b9f78b500f5b3aba9321a5d42e1

SHA256
8397681fb127b7050397870b95f23d310f2e62ee5c2e3a7410d2daeec99e9e06

SHA512
b199abfc0abe5f46873ceaccd287e973a6285d40caeb9320f126bfdc081f4bbd8dc706a2a2ca74a305fd5666772db877cb6bc1ea35448585941b1f191405779e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe
MD5
8d97ea0aeb6dbb5bfe61a2a45809dd90

SHA1
c2abdfefadc76b9f78b500f5b3aba9321a5d42e1

SHA256
8397681fb127b7050397870b95f23d310f2e62ee5c2e3a7410d2daeec99e9e06

SHA512
b199abfc0abe5f46873ceaccd287e973a6285d40caeb9320f126bfdc081f4bbd8dc706a2a2ca74a305fd5666772db877cb6bc1ea35448585941b1f191405779e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe
MD5
8d97ea0aeb6dbb5bfe61a2a45809dd90

SHA1
c2abdfefadc76b9f78b500f5b3aba9321a5d42e1

SHA256
8397681fb127b7050397870b95f23d310f2e62ee5c2e3a7410d2daeec99e9e06

SHA512
b199abfc0abe5f46873ceaccd287e973a6285d40caeb9320f126bfdc081f4bbd8dc706a2a2ca74a305fd5666772db877cb6bc1ea35448585941b1f191405779e

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe
MD5
8d97ea0aeb6dbb5bfe61a2a45809dd90

SHA1
c2abdfefadc76b9f78b500f5b3aba9321a5d42e1

SHA256
8397681fb127b7050397870b95f23d310f2e62ee5c2e3a7410d2daeec99e9e06

SHA512
b199abfc0abe5f46873ceaccd287e973a6285d40caeb9320f126bfdc081f4bbd8dc706a2a2ca74a305fd5666772db877cb6bc1ea35448585941b1f191405779e

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe
MD5
8d97ea0aeb6dbb5bfe61a2a45809dd90

SHA1
c2abdfefadc76b9f78b500f5b3aba9321a5d42e1

SHA256
8397681fb127b7050397870b95f23d310f2e62ee5c2e3a7410d2daeec99e9e06

SHA512
b199abfc0abe5f46873ceaccd287e973a6285d40caeb9320f126bfdc081f4bbd8dc706a2a2ca74a305fd5666772db877cb6bc1ea35448585941b1f191405779e

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe
MD5
8d97ea0aeb6dbb5bfe61a2a45809dd90

SHA1
c2abdfefadc76b9f78b500f5b3aba9321a5d42e1

SHA256
8397681fb127b7050397870b95f23d310f2e62ee5c2e3a7410d2daeec99e9e06

SHA512
b199abfc0abe5f46873ceaccd287e973a6285d40caeb9320f126bfdc081f4bbd8dc706a2a2ca74a305fd5666772db877cb6bc1ea35448585941b1f191405779e

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe
MD5
8d97ea0aeb6dbb5bfe61a2a45809dd90

SHA1
c2abdfefadc76b9f78b500f5b3aba9321a5d42e1

SHA256
8397681fb127b7050397870b95f23d310f2e62ee5c2e3a7410d2daeec99e9e06

SHA512
b199abfc0abe5f46873ceaccd287e973a6285d40caeb9320f126bfdc081f4bbd8dc706a2a2ca74a305fd5666772db877cb6bc1ea35448585941b1f191405779e

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\931568b982ac42dd2edc68ff203ec101.exe
MD5
8d97ea0aeb6dbb5bfe61a2a45809dd90

SHA1
c2abdfefadc76b9f78b500f5b3aba9321a5d42e1

SHA256
8397681fb127b7050397870b95f23d310f2e62ee5c2e3a7410d2daeec99e9e06

SHA512
b199abfc0abe5f46873ceaccd287e973a6285d40caeb9320f126bfdc081f4bbd8dc706a2a2ca74a305fd5666772db877cb6bc1ea35448585941b1f191405779e

Download Submit
\Users\Admin\AppData\Local\Temp\nstCD6E.tmp\vskgzcgvn.dll
MD5
879fe70b7d9b58770c4c5ff43b6af498

SHA1
f9fd57ae071014e5ccb32440ee52d2c51166a0c3

SHA256
cabc6346c99a2f74c7cac1d4c1f83538cce9b0047c8437e240af03338b73f192

SHA512
49a6740fea7f230da9808b46b6f2f896c05894b4dad923cbdd1fec0859e4bd4afc2fddca4655b7d2e3553e5e36605f73db2b64fde9a509a4fcf957eec87d3773

Download Submit
memory/360-74-0x0000000000000000-mapping.dmp

Download
memory/360-79-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/796-57-0x0000000000000000-mapping.dmp

Download
memory/1424-63-0x0000000000000000-mapping.dmp

Download
memory/1424-69-0x00000000001C0000-0x00000000001DB000-memory.dmp

Filesize
108KB

Download
memory/1424-65-0x00000000001C0000-0x00000000001DB000-memory.dmp

Filesize
108KB

Download
memory/1648-55-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download

description	pid	process	target process
PID 1648 wrote to memory of 796	1648	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 1648 wrote to memory of 796	1648	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 1648 wrote to memory of 796	1648	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 1648 wrote to memory of 796	1648	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 796 wrote to memory of 1424	796	931568b982ac42dd2edc68ff203ec101.exe	931568b982ac42dd2edc68ff203ec101.exe
PID 1424 wrote to memory of 360	1424	931568b982ac42dd2edc68ff203ec101.exe	WerFault.exe
PID 1424 wrote to memory of 360	1424	931568b982ac42dd2edc68ff203ec101.exe	WerFault.exe
PID 1424 wrote to memory of 360	1424	931568b982ac42dd2edc68ff203ec101.exe	WerFault.exe
PID 1424 wrote to memory of 360	1424	931568b982ac42dd2edc68ff203ec101.exe	WerFault.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads