Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-06-2022 22:23
Behavioral task
behavioral1
Sample
9f3c9768f9a0105f0642afe9a6b8ed4c99d6fca1a97c4624cf8f1a3d3866a401.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
9f3c9768f9a0105f0642afe9a6b8ed4c99d6fca1a97c4624cf8f1a3d3866a401.exe
-
Size
909KB
-
MD5
d3b158ba2a81b4ddc15491ec4f7aa64b
-
SHA1
44f60b8bb5cb309bbdda1197f9d716fe77d831ae
-
SHA256
9f3c9768f9a0105f0642afe9a6b8ed4c99d6fca1a97c4624cf8f1a3d3866a401
-
SHA512
77ae26fc01a6243fa4cc02d8dc3aa62ce88b7fbb473ca758ca6e11c9f36d9e3b0278e1bfb1b1802b2d99893b4c19295f75b30baa7429843eb4d7d6d28406d3f7
Malware Config
Extracted
Family
gozi_rm3
Attributes
-
build
300854
Extracted
Family
gozi_rm3
Botnet
202004141
C2
https://devicelease.xyz
Attributes
-
build
300854
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD3AfU4ayUEHchQ3H0W1/d3ziW
3
VNCFHWaAm8mJq6hQwn03GNGV7hOICH8h/+dZGEwYWVnRq128QMPZTIj0b+iqHKlM
4
sHzxEIZlWUVvnfbx6unDAC8aJXovmePrPvbHJ1FrplzlbILiPLvofh7pXzTdfcDQ
5
e3wfV7cbxJ3DXessqwIDAQAB
6
-----END PUBLIC KEY-----
serpent.plain
1
8JbpEEfNYPlYoAN4
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ba689d2a88d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de0a1e983134cf4e883f258c38579ff00000000002000000000010660000000100002000000056c6867d65926e34ca1b8543aad684b9fcd36e300e72ce546415604ac49200c4000000000e8000000002000020000000e73d8a76b02f796b2ec75e452da9dfdabca2170d650280e57d10e4c332435924200000006b28cbe182439ad2d25eb2a8b8991511998a36b280fd1ed0a828359e96705f5b400000009f6181a49dc6d17fac2f10e7619b5ee8f0eb3adf1d5b5bbfc41aa6aa7830b1052a6181311a321a3dc5643987880e26f0a427545b6d9545ff36c452a24583128d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2356985197" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c51fc42a88d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de0a1e983134cf4e883f258c38579ff00000000002000000000010660000000100002000000061265887813d5f74ab9abee1abbbdad61b29941c6d3a116c0738830ebc904f4a000000000e8000000002000020000000e040707ebc9ffdb2cbabac757ada7afcb05dc2b056f7fcc2cbffe62ec064298320000000fc4754c09b8962e2307a35d24461be20db1c96676e3c260b81490b49638ed3d0400000004f909dc3d18d4971f37c0ec759593bcd4a6cbd9800d81d5746849121237bf53695b96077da9b2d9e5666c10cf86002cb61166ef1aedbf37e54962c7331802f97 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de0a1e983134cf4e883f258c38579ff000000000020000000000106600000001000020000000fdd3d5e713a6882d765f6f527d4eb35c400edb5489bc9d712932d9bc5ea6d7e1000000000e8000000002000020000000caed56b9e53ddc05efe12667ace1028bb1bb2e72a9f2b1d0c0ede686246c48b62000000041c404e174dd5336bff28fb930113d93a277fc0ac07c8020e44b904a6fd1651040000000dfcf31cd007148766a60721ec87a5e98bfb7101d88196d52c5a15150de7c3f019d3ddaaff07e706b2f20d6d97fc51b55fee79325ba70d526c014d1ca4bc237cf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CC6CA2D1-F41D-11EC-B274-FA63415F8E77} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703a43b72a88d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2356985197" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2035438f2a88d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de0a1e983134cf4e883f258c38579ff000000000020000000000106600000001000020000000e75650cc9bca66d6f3e2e9836fb58cf5d0ed2b8071801a67292c61747ba0f3b8000000000e8000000002000020000000775c0b917ba6a950fd33810cee7c97a78da7ece90f607fb7dcc5c17be4fc8acb20000000423dd9db5bd976d7cc4d3aef74b72042454786412d3371eea30acc14a1a45252400000002e15834a6ccad00d468d4df5c1fd72ae467c6d8901e0af2d81157f20f29b15c7ffa0678374172cdf40c357f29853c7a163feb5664e63029567b85d2b76eaf2fc iexplore.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4116 iexplore.exe 4116 iexplore.exe 5056 iexplore.exe 2628 iexplore.exe 4496 iexplore.exe 3992 iexplore.exe 4288 iexplore.exe -
Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4116 iexplore.exe 4116 iexplore.exe 4136 IEXPLORE.EXE 4136 IEXPLORE.EXE 4116 iexplore.exe 4116 iexplore.exe 424 IEXPLORE.EXE 424 IEXPLORE.EXE 5056 iexplore.exe 5056 iexplore.exe 4800 IEXPLORE.EXE 4800 IEXPLORE.EXE 2628 iexplore.exe 2628 iexplore.exe 4744 IEXPLORE.EXE 4744 IEXPLORE.EXE 4496 iexplore.exe 4496 iexplore.exe 4260 IEXPLORE.EXE 4260 IEXPLORE.EXE 3992 iexplore.exe 3992 iexplore.exe 376 IEXPLORE.EXE 376 IEXPLORE.EXE 4288 iexplore.exe 4288 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4116 wrote to memory of 4136 4116 iexplore.exe 82 PID 4116 wrote to memory of 4136 4116 iexplore.exe 82 PID 4116 wrote to memory of 4136 4116 iexplore.exe 82 PID 4116 wrote to memory of 424 4116 iexplore.exe 85 PID 4116 wrote to memory of 424 4116 iexplore.exe 85 PID 4116 wrote to memory of 424 4116 iexplore.exe 85 PID 5056 wrote to memory of 4800 5056 iexplore.exe 94 PID 5056 wrote to memory of 4800 5056 iexplore.exe 94 PID 5056 wrote to memory of 4800 5056 iexplore.exe 94 PID 2628 wrote to memory of 4744 2628 iexplore.exe 96 PID 2628 wrote to memory of 4744 2628 iexplore.exe 96 PID 2628 wrote to memory of 4744 2628 iexplore.exe 96 PID 4496 wrote to memory of 4260 4496 iexplore.exe 98 PID 4496 wrote to memory of 4260 4496 iexplore.exe 98 PID 4496 wrote to memory of 4260 4496 iexplore.exe 98 PID 3992 wrote to memory of 376 3992 iexplore.exe 100 PID 3992 wrote to memory of 376 3992 iexplore.exe 100 PID 3992 wrote to memory of 376 3992 iexplore.exe 100 PID 4288 wrote to memory of 2612 4288 iexplore.exe 102 PID 4288 wrote to memory of 2612 4288 iexplore.exe 102 PID 4288 wrote to memory of 2612 4288 iexplore.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f3c9768f9a0105f0642afe9a6b8ed4c99d6fca1a97c4624cf8f1a3d3866a401.exe"C:\Users\Admin\AppData\Local\Temp\9f3c9768f9a0105f0642afe9a6b8ed4c99d6fca1a97c4624cf8f1a3d3866a401.exe"1⤵PID:2872
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:3108
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4116 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4136
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4116 CREDAT:82950 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:424
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5056 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4800
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:17410 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:4744
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4496 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4260
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3992 CREDAT:17410 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:376
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4288 CREDAT:17410 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:2612
-
Network
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Request106.89.54.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
Remote address:8.8.8.8:53Requestdevicelease.xyzIN AResponse
-
260 B 5
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 61 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 61 B 1 1
DNS Request
devicelease.xyz
-
71 B 157 B 1 1
DNS Request
106.89.54.20.in-addr.arpa
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz
-
61 B 126 B 1 1
DNS Request
devicelease.xyz