dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323

General

Target

dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
Size

33KB
MD5

3499b6e1dfa63a3e59e8d21cd7871bde
SHA1

8d180febba9d1bcea2ea9db93d3d4c812156be47
SHA256

dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323
SHA512

61097e32a70537953b2d0d82b471f47adde7ecc671718649c614b0ef2e18a0e70ffaaebb9239741f8581bc172b29e5c38da2f48b535f72070370ca91101d3ba9
SSDEEP

768:P4X/IElOIEvzMXqtwp/lttaL7HP4wIncLRdR5kP78a0RJW/a:PKIaYzMXqtGNttyUn01Q78a4R

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe

description	ioc	process
File opened (read-only)	\??\N:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\M:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\H:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\Z:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\V:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\U:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\T:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\L:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\Y:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\W:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\Q:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\I:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\E:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\X:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\S:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\R:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\P:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\O:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\K:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\J:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\G:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened (read-only)	\??\F:	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe

Drops file in Program Files directory 64 IoCs

Processes:

dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Google\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\7-Zip\Lang\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\cmm\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\rsod\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\_desktop.ini	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe

Drops file in Windows directory 2 IoCs

Processes:

dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
File created	C:\Windows\Dll.dll	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe

pid	process
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exenet.exenet.exe

description	pid	process	target process
PID 3160 wrote to memory of 2220	3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe	net.exe
PID 3160 wrote to memory of 2220	3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe	net.exe
PID 3160 wrote to memory of 2220	3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe	net.exe
PID 2220 wrote to memory of 1736	2220	net.exe	net1.exe
PID 2220 wrote to memory of 1736	2220	net.exe	net1.exe
PID 2220 wrote to memory of 1736	2220	net.exe	net1.exe
PID 3160 wrote to memory of 1760	3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe	net.exe
PID 3160 wrote to memory of 1760	3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe	net.exe
PID 3160 wrote to memory of 1760	3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe	net.exe
PID 1760 wrote to memory of 4972	1760	net.exe	net1.exe
PID 1760 wrote to memory of 4972	1760	net.exe	net1.exe
PID 1760 wrote to memory of 4972	1760	net.exe	net1.exe
PID 3160 wrote to memory of 2616	3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe	Explorer.EXE
PID 3160 wrote to memory of 2616	3160	dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2616

C:\Users\Admin\AppData\Local\Temp\dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe
"C:\Users\Admin\AppData\Local\Temp\dab65ff785fab0525e1d04cda78d76001c3fce7be9b47b6d04260fe7bf0a7323.exe"
2⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3160

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:1736

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:4972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-134-0x0000000000000000-mapping.dmp

Download
memory/1760-135-0x0000000000000000-mapping.dmp

Download
memory/2220-132-0x0000000000000000-mapping.dmp

Download
memory/3160-133-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3160-137-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4972-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads