Analysis
-
max time kernel
204s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe
-
Size
42KB
-
MD5
0d95d37aca63976b5236ee4903ea500c
-
SHA1
4cf56e341c7e04bfaa806c932aff4fe1b275377a
-
SHA256
26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706
-
SHA512
40513867e83daa289c257c2b2056191e6588215db43d653de1703455f1ba076eaa5218a912ede1c943f4a3663ed47390926c4f2c05411ed8d7c8688b944e1b25
-
SSDEEP
768:4ATmi5qNWxmcnc8uK8fNh4wD5dqJ2F6ePBs06uaPVHn9Vb5q37BxrkXDjwLn:jTYN2myxu9Nn6J2Fhs0HadHnDbK7Bxr1
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\X: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\T: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\R: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\F: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\E: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\Z: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\W: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\J: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\P: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\M: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\L: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\K: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\H: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\Y: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\V: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\Q: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\I: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\G: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\U: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\S: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened (read-only) \??\N: 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\vfs\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Mozilla Firefox\fonts\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files\VideoLAN\VLC\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\VideoLAN\VLC\locale\or\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\_desktop.ini 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe File created C:\Windows\Dll.dll 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2900 wrote to memory of 4376 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 79 PID 2900 wrote to memory of 4376 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 79 PID 2900 wrote to memory of 4376 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 79 PID 4376 wrote to memory of 4168 4376 net.exe 81 PID 4376 wrote to memory of 4168 4376 net.exe 81 PID 4376 wrote to memory of 4168 4376 net.exe 81 PID 2900 wrote to memory of 700 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 52 PID 2900 wrote to memory of 700 2900 26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe 52
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe"C:\Users\Admin\AppData\Local\Temp\26b830aed74c3b8430ffed09cff32ff19fa833bd2216c1be42322af7c53f0706.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4168
-
-
-