Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
20/02/2022, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
Seznam narocil.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target Seznam narocil.exe
- Size 816KB
- Sample220220-2w85aacghp
- SHA256 8051703485faca901060ae5b39054e5efee88909d2e1d4bb0f65126cda3230c1
- MD5 d5bd01e259589a924c0eb68bffe1de14
- SHA1 5b6a95167654ae76115204ed0f54c29ded3eeba8
- SHA512 ba85579a38dce06a21a69a482c763f986ddc70056cdd96a7f21598c94fb5cbdcb220af7dc6a0c8de3d4afef40f5e35a748eb359a83abbd912923b48bcd1ad10e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
euv4
Decoy
-
anniebapartments.com
-
hagenbicycles.com
-
herbalist101.com
-
southerncorrosion.net
-
kuechenpruefer.com
-
tajniezdrzi.quest
-
segurofunerarioar.com
-
boardsandbeamsdecor.com
-
alifdanismanlik.com
-
pkem.top
-
mddc.clinic
-
handejqr.com
-
crux-at.com
-
awp.email
-
hugsforbubbs.com
-
cielotherepy.com
-
turkcuyuz.com
-
teamidc.com
-
lankasirinspa.com
-
68135.online
-
oprimanumerodos.com
-
launchclik.com
-
customapronsnow.com
-
thecuratedpour.com
-
20dzwww.com
-
encludemedia.com
-
kreativevisibility.net
-
mehfeels.com
-
oecmgroup.com
-
alert78.info
-
1207rossmoyne.com
-
spbutoto.com
-
t1uba.com
-
protection-onepa.com
-
byausorsm26-plala.xyz
-
bestpleasure4u.com
-
allmnlenem.quest
-
mobilpartes.com
-
fabio.tools
-
bubu3cin.com
-
nathanmartinez.digital
-
shristiprintingplaces.com
-
silkyflawless.com
-
berylgrote.top
-
laidbackfurniture.store
-
leatherman-neal.com
-
uschargeport.com
-
the-pumps.com
-
deepootech.com
-
drimev.com
-
seo-art.agency
-
jasabacklinkweb20.com
-
tracynicolalamond.com
-
dandtglaziers.com
-
vulacils.com
-
bendyourtongue.com
-
gulfund.com
-
ahmadfaizlajis.com
-
595531.com
-
metavillagehub.com
-
librairie-adrienne.com
-
77777.store
-
gongwenbo.com
-
game2plays.com
-
rematedeldia.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/1252-136-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral2/memory/4020-143-0x0000000002CD0000-0x0000000002CF9000-memory.dmp xloader - Executes dropped EXE 1 IoCs
pid Process 1224 vxvhxvto.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EL-D3PZXDH = "C:\\Program Files (x86)\\Dy2sdanlx\\vxvhxvto.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fsthhej = "C:\\Users\\Public\\jehhtsF.url" Seznam narocil.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1252 set thread context of 2436 1252 logagent.exe 33 PID 4020 set thread context of 2436 4020 explorer.exe 33 - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Dy2sdanlx\vxvhxvto.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Dy2sdanlx\vxvhxvto.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Dy2sdanlx\vxvhxvto.exe explorer.exe File opened for modification C:\Program Files (x86)\Dy2sdanlx Explorer.EXE - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
description ioc Process Key created \Registry\User\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132900478409216299" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.923335" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "26.961689" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4088" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4300" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3924" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "9.427111" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1252 logagent.exe 1252 logagent.exe 1252 logagent.exe 1252 logagent.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2436 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1252 logagent.exe 1252 logagent.exe 1252 logagent.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe Token: SeRestorePrivilege 3628 TiWorker.exe Token: SeSecurityPrivilege 3628 TiWorker.exe Token: SeBackupPrivilege 3628 TiWorker.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3780 wrote to memory of 1252 3780 Seznam narocil.exe 73 PID 3780 wrote to memory of 1252 3780 Seznam narocil.exe 73 PID 3780 wrote to memory of 1252 3780 Seznam narocil.exe 73 PID 3780 wrote to memory of 1252 3780 Seznam narocil.exe 73 PID 3780 wrote to memory of 1252 3780 Seznam narocil.exe 73 PID 3780 wrote to memory of 1252 3780 Seznam narocil.exe 73 PID 2436 wrote to memory of 4020 2436 Explorer.EXE 76 PID 2436 wrote to memory of 4020 2436 Explorer.EXE 76 PID 2436 wrote to memory of 4020 2436 Explorer.EXE 76 PID 4020 wrote to memory of 2652 4020 explorer.exe 79 PID 4020 wrote to memory of 2652 4020 explorer.exe 79 PID 4020 wrote to memory of 2652 4020 explorer.exe 79 PID 4020 wrote to memory of 732 4020 explorer.exe 86 PID 4020 wrote to memory of 732 4020 explorer.exe 86 PID 4020 wrote to memory of 732 4020 explorer.exe 86 PID 4020 wrote to memory of 2096 4020 explorer.exe 88 PID 4020 wrote to memory of 2096 4020 explorer.exe 88 PID 2436 wrote to memory of 1224 2436 Explorer.EXE 89 PID 2436 wrote to memory of 1224 2436 Explorer.EXE 89 PID 2436 wrote to memory of 1224 2436 Explorer.EXE 89 PID 4020 wrote to memory of 2096 4020 explorer.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\Seznam narocil.exe"C:\Users\Admin\AppData\Local\Temp\Seznam narocil.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1252
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:3640
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3276
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵PID:2652
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:732
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2096
-
-
-
C:\Program Files (x86)\Dy2sdanlx\vxvhxvto.exe"C:\Program Files (x86)\Dy2sdanlx\vxvhxvto.exe"2⤵
- Executes dropped EXE
PID:1224
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3376
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1408
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3628