Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 18:51
Static task
static1
Behavioral task
behavioral1
Sample
4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe
-
Size
39KB
-
MD5
8a3b9e40a14334cceb40273473ea1720
-
SHA1
0c4dea469d2dcc4741f0368f7d12a9b79d7a6887
-
SHA256
4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a
-
SHA512
c7d39433ca797ec739119d736a41ffbf80d06ba91aa649d0236a105bb7980d8d0583bd76dc7793107419da0c3525dc88f6c0f142c047177dd6702ee8b05f2cd4
-
SSDEEP
768:znhO5RroZJ76739/dZVdfpULiAYXjPrN+8WEjrZMYjV8mp8w:znhe+Zk7VJbwlYXjPrsqrZMYR5p8w
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\S: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\Q: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\R: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\N: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\F: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\Y: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\W: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\V: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\U: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\H: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\E: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\T: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\P: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\O: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\I: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\J: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\G: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\X: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\M: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\L: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened (read-only) \??\K: 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pl-pl\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Schema\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\eu-es\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\_desktop.ini 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe File created C:\Windows\Dll.dll 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4372 wrote to memory of 1100 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 81 PID 4372 wrote to memory of 1100 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 81 PID 4372 wrote to memory of 1100 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 81 PID 1100 wrote to memory of 5076 1100 net.exe 83 PID 1100 wrote to memory of 5076 1100 net.exe 83 PID 1100 wrote to memory of 5076 1100 net.exe 83 PID 4372 wrote to memory of 5068 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 84 PID 4372 wrote to memory of 5068 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 84 PID 4372 wrote to memory of 5068 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 84 PID 5068 wrote to memory of 5000 5068 net.exe 86 PID 5068 wrote to memory of 5000 5068 net.exe 86 PID 5068 wrote to memory of 5000 5068 net.exe 86 PID 4372 wrote to memory of 3036 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 67 PID 4372 wrote to memory of 3036 4372 4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe 67
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe"C:\Users\Admin\AppData\Local\Temp\4e19f1f774a77518c3823c83c9677728d3fab3b4c5feebae03dcc3b262e66f9a.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:5076
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:5000
-
-
-