4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a

Analysis

max time kernel
149s
max time network
73s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
Size

39KB
MD5

8a3b9e40a14334cceb40273473ea1720
SHA1

0c4dea469d2dcc4741f0368f7d12a9b79d7a6887
SHA256

4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a
SHA512

c7d39433ca797ec739119d736a41ffbf80d06ba91aa649d0236a105bb7980d8d0583bd76dc7793107419da0c3525dc88f6c0f142c047177dd6702ee8b05f2cd4
SSDEEP

768:znhO5RroZJ76739/dZVdfpULiAYXjPrN+8WEjrZMYjV8mp8w:znhe+Zk7VJbwlYXjPrsqrZMYR5p8w

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\R:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\P:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\M:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\L:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\G:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\Z:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\X:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\S:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\Q:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\J:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\H:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\Y:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\W:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\T:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\K:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\E:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\U:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\O:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\N:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\I:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened (read-only)	\??\F:	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\de-DE\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Common Files\Services\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Mozilla Firefox\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
File created	C:\Windows\Dll.dll	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1644	1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe	27
PID 1672 wrote to memory of 1644	1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe	27
PID 1672 wrote to memory of 1644	1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe	27
PID 1672 wrote to memory of 1644	1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe	27
PID 1644 wrote to memory of 984	1644	net.exe	29
PID 1644 wrote to memory of 984	1644	net.exe	29
PID 1644 wrote to memory of 984	1644	net.exe	29
PID 1644 wrote to memory of 984	1644	net.exe	29
PID 1672 wrote to memory of 240	1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe	30
PID 1672 wrote to memory of 240	1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe	30
PID 1672 wrote to memory of 240	1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe	30
PID 1672 wrote to memory of 240	1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe	30
PID 240 wrote to memory of 1100	240	net.exe	32
PID 240 wrote to memory of 1100	240	net.exe	32
PID 240 wrote to memory of 1100	240	net.exe	32
PID 240 wrote to memory of 1100	240	net.exe	32
PID 1672 wrote to memory of 1260	1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe	18
PID 1672 wrote to memory of 1260	1672	4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe	18

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
  "C:\Users\Admin\AppData\Local\Temp\4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:984
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-56-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1672-59-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download