22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f

General

Target

22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
Size

33KB
MD5

029f490254f0ac73b183d6af58652d40
SHA1

a2c582b1682ac07cd237a3fb76c203630be5d52e
SHA256

22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f
SHA512

f44cb113b3ec623103bd879ad62b5afa22fe06e60549192b572feb38eef459c21d826716809da3bf3f03bc4b5cbb1535e006f453fc8c9c244d2751ae7ba2c30c
SSDEEP

768:GeCUvblvmO5RroZJ76739sBWsYducUCgFGPb:G8Zvme+Zk78SubCgFGP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe

description	ioc	process
File opened (read-only)	\??\E:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\Y:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\T:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\R:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\O:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\M:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\J:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\I:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\Q:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\P:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\L:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\H:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\F:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\S:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\G:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\Z:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\X:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\W:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\V:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\U:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\N:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened (read-only)	\??\K:	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe

Drops file in Program Files directory 64 IoCs

Processes:

22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bs\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Microsoft Games\Solitaire\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Microsoft Games\Mahjong\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Internet Explorer\ja-JP\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\es-ES\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\_desktop.ini	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe

Drops file in Windows directory 2 IoCs

Processes:

22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
File created	C:\Windows\Dll.dll	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe

pid	process
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exenet.exenet.exe

description	pid	process	target process
PID 1032 wrote to memory of 1508	1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe	net.exe
PID 1032 wrote to memory of 1508	1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe	net.exe
PID 1032 wrote to memory of 1508	1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe	net.exe
PID 1032 wrote to memory of 1508	1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe	net.exe
PID 1508 wrote to memory of 688	1508	net.exe	net1.exe
PID 1508 wrote to memory of 688	1508	net.exe	net1.exe
PID 1508 wrote to memory of 688	1508	net.exe	net1.exe
PID 1508 wrote to memory of 688	1508	net.exe	net1.exe
PID 1032 wrote to memory of 1732	1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe	net.exe
PID 1032 wrote to memory of 1732	1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe	net.exe
PID 1032 wrote to memory of 1732	1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe	net.exe
PID 1032 wrote to memory of 1732	1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe	net.exe
PID 1732 wrote to memory of 1132	1732	net.exe	net1.exe
PID 1732 wrote to memory of 1132	1732	net.exe	net1.exe
PID 1732 wrote to memory of 1132	1732	net.exe	net1.exe
PID 1732 wrote to memory of 1132	1732	net.exe	net1.exe
PID 1032 wrote to memory of 1264	1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe	Explorer.EXE
PID 1032 wrote to memory of 1264	1032	22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1264

C:\Users\Admin\AppData\Local\Temp\22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe
"C:\Users\Admin\AppData\Local\Temp\22ab478c04b3a6ed95fb6efd6e997ffaf6d05332a6d0d1f5c722b05324b8a13f.exe"
2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:688

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/688-55-0x0000000000000000-mapping.dmp

Download
memory/1032-56-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1032-59-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1132-58-0x0000000000000000-mapping.dmp

Download
memory/1508-54-0x0000000000000000-mapping.dmp

Download
memory/1732-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads