Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe
Resource
win7-20230712-en
windows7-x64
7 signatures
150 seconds
General
-
Target
37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe
-
Size
33KB
-
MD5
36e3596f9c1e223688f6de54bab9f62a
-
SHA1
ed95c7c3e48492bff85d3d7bf19712abf5ebd5d7
-
SHA256
37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9
-
SHA512
7e57eb06d20bcdc72f6f6a8c93e678abceac005ccae19668028260913e1d6d2eab32e0c241275ad311545408764b6d76d9ca5d15565e347e7ddf20c43ae7cc60
-
SSDEEP
768:AKuchyO5RroZJ767395uINH2iTQKvFrQ2XKxgkQe:AKuchye+Zk77RNH2iT919XKKkQe
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\U: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\J: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\E: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\Z: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\Y: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\N: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\L: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\G: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\W: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\P: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\S: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\K: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\H: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\X: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\T: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\O: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\M: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\I: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\R: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened (read-only) \??\Q: 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files\Windows Media Player\Media Renderer\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\it-it\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ar-ae\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files\Windows Photo Viewer\ja-JP\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\_desktop.ini 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe File created C:\Windows\Dll.dll 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1704 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 83 PID 1720 wrote to memory of 1704 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 83 PID 1720 wrote to memory of 1704 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 83 PID 1704 wrote to memory of 3704 1704 net.exe 85 PID 1704 wrote to memory of 3704 1704 net.exe 85 PID 1704 wrote to memory of 3704 1704 net.exe 85 PID 1720 wrote to memory of 2148 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 86 PID 1720 wrote to memory of 2148 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 86 PID 1720 wrote to memory of 2148 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 86 PID 2148 wrote to memory of 3844 2148 net.exe 88 PID 2148 wrote to memory of 3844 2148 net.exe 88 PID 2148 wrote to memory of 3844 2148 net.exe 88 PID 1720 wrote to memory of 2584 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 33 PID 1720 wrote to memory of 2584 1720 37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe"C:\Users\Admin\AppData\Local\Temp\37a07cdb3e94885a8eff37498c22efff40decf30f130bde650cbb75ec24eded9.exe"2⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3704
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3844
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5419ead08a10027f035ab653b2dacce47
SHA11cd50843a833017b63b7076b4024d5bcbe1574d8
SHA2567759ff95821dde9a5b9871b0383a1474680b5ae8a37d5628e6772b023df7674f
SHA5124f22deb3300c9e0ea9a72ce180383f46fe20eab20b6bbeb72c636bf9fea9bb4eb34a624d0270b28fc86c0a9c93d3b51f252f5c62c1e879ab0392354345e50f96
-
Filesize
2.8MB
MD51cf714582f27e0446d1a47fa81da6466
SHA183b01c2a98a6045ac2b78db2988e7c916068d90c
SHA256f649cb845384ab7acb9b2d093fd52d836a680435703bfc856c96f386eb569ca9
SHA512f6c2eb9bb0742e53bc8f2f7c8ee59799148dabf723fe4dfb1aa3f41dec1abe4a8bf247e0484ea973bad3338448ae32d2d7c86a4670fdf62d326d47e5562ca291
-
Filesize
478KB
MD5c9e32c9ce2e82d3261fc69d079b70f7d
SHA11a5b1a64276c510a3ed7c7066ac1a116a39e7eb2
SHA256aeb095c00a46b38559c56d837ed087f191abd2934afc305621f673bb89a12dbe
SHA5128c6ff588d6d85e9b664e57486f8c0211a0c2727a02f40e9cd80adde178ca30e7a2b3377c4c1d9aab630fcb7aac8cf6466a9f4a8ca515149856f7849b88944806
-
Filesize
9B
MD52326d479b287193a70f520700dc8d23e
SHA1afea66d3788a50debd6f5d4c9dd51f68a4477e64
SHA25695d41561a1467d20977f59108e85da181e0b4dfd3db9e40182ae7378c4a927f8
SHA512cb971c406ddf7147536a6a1569d4ff49d7219aa52cde5d110be1109874d66daace832d423d7969af9e6bbc9738a65734c7e68e994591b7677aad51fa0f52cf37