Analysis
-
max time kernel
153s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2023, 23:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b530e5b3cb6b6a4e4d9b7c8960f2a2d01fa3221197ef26bbfda4d9813c82707.dll
Resource
win7-20230831-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2b530e5b3cb6b6a4e4d9b7c8960f2a2d01fa3221197ef26bbfda4d9813c82707.dll
-
Size
2.6MB
-
MD5
b61949c9b0b3ecfa9d0e4376914f490c
-
SHA1
9d74935d585588a367d4c8da5960fd3071561f0f
-
SHA256
2b530e5b3cb6b6a4e4d9b7c8960f2a2d01fa3221197ef26bbfda4d9813c82707
-
SHA512
afd1a8bb4ae0715f0fc33200d3bde56e5efa98c81596bfa045a15a58fe860b7dac6e319f62c2bbc4aacedcd288c17525af1888e196bc7a4c4100c6e1263bbe9f
-
SSDEEP
49152:Am1AUh2/G7ubvX185Z4+EvVO/xMlEFEpXhEQTZ1lsc07PFz8jvOARXUNqMrFJ0y8:1ulG74vlyZ4PvwAEw2B8jvVRCqEGwl6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4812 F4B0.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 53 IoCs
description ioc Process File created C:\Windows\SysWOW64\mspbde40.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll F4B0.tmp File created C:\Windows\SysWOW64\odbcjt32.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll F4B0.tmp File created C:\Windows\SysWOW64\mfc40.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\PrintConfig.dll F4B0.tmp File created C:\Windows\SysWOW64\expsrv.dll F4B0.tmp File created C:\Windows\SysWOW64\FXSXP32.dll F4B0.tmp File created C:\Windows\SysWOW64\ir50_32original.dll F4B0.tmp File created C:\Windows\SysWOW64\msrd3x40.dll F4B0.tmp File created C:\Windows\SysWOW64\sqlunirl.dll F4B0.tmp File created C:\Windows\SysWOW64\acwow64.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll F4B0.tmp File created C:\Windows\SysWOW64\msjtes40.dll F4B0.tmp File created C:\Windows\SysWOW64\gnsdk_fp.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll F4B0.tmp File created C:\Windows\SysWOW64\msvcrt20.dll F4B0.tmp File created C:\Windows\SysWOW64\crtdll.dll F4B0.tmp File created C:\Windows\SysWOW64\ir32_32original.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll F4B0.tmp File created C:\Windows\SysWOW64\rdvgogl32.dll F4B0.tmp File created C:\Windows\SysWOW64\msvbvm60.dll F4B0.tmp File created C:\Windows\SysWOW64\msxbde40.dll F4B0.tmp File created C:\Windows\SysWOW64\olesvr32.dll F4B0.tmp File created C:\Windows\SysWOW64\hh.exe F4B0.tmp File created C:\Windows\SysWOW64\msjet40.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll F4B0.tmp File created C:\Windows\SysWOW64\d3dim.dll F4B0.tmp File created C:\Windows\SysWOW64\OneDriveSetup.exe F4B0.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll F4B0.tmp File created C:\Windows\SysWOW64\mswstr10.dll F4B0.tmp File created C:\Windows\SysWOW64\msorcl32.dll F4B0.tmp File created C:\Windows\SysWOW64\d3d8.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll F4B0.tmp File created C:\Windows\SysWOW64\msexch40.dll F4B0.tmp File created C:\Windows\SysWOW64\ivfsrc.ax F4B0.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\opencl.dll F4B0.tmp File created C:\Windows\SysWOW64\AppVEntSubsystems32.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll F4B0.tmp File created C:\Windows\SysWOW64\d3dxof.dll F4B0.tmp File created C:\Windows\SysWOW64\msrepl40.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll F4B0.tmp File created C:\Windows\SysWOW64\iac25_32.ax F4B0.tmp File created C:\Windows\SysWOW64\olecli32.dll F4B0.tmp File created C:\Windows\SysWOW64\sqlwoa.dll F4B0.tmp File created C:\Windows\SysWOW64\ir41_32original.dll F4B0.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll F4B0.tmp File created C:\Windows\SysWOW64\mfc40u.dll F4B0.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\rt3d.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\adal.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msolap.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\URLREDIR.DLL F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWER.DLL F4B0.tmp File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\EmbeddedBrowserWebView.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\concrt140.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msmdlocal.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ExtendScript.dll F4B0.tmp File opened for modification C:\Program Files\7-Zip\7z.sfx F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\dbghelp.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libGLESv2.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe F4B0.tmp File opened for modification C:\Program Files\7-Zip\7zCon.sfx F4B0.tmp File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll F4B0.tmp File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp F4B0.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdate.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\JitV.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\nppdf32.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api F4B0.tmp File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_bho.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso30win32client.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso98win32client.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe F4B0.tmp File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\IEAWSDC.DLL F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\adoberfp.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\sqlite.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ONNXRuntime-0.5.X.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OLKFSTUB.DLL F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\Interceptor.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\STSCOPY.DLL F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAME.DLL F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\logsession.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_43.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\mfc140u.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\concrt140.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso50win32client.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\PPSLAX.DLL F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\mfc140u.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\PortalConnectCore.dll F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msmgdsrv.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ScCore.dll F4B0.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe F4B0.tmp File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe F4B0.tmp File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe F4B0.tmp File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll F4B0.tmp -
Drops file in Windows directory 62 IoCs
description ioc Process File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86 F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\SaveAsRTF.api_NON_OPT F4B0.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico F4B0.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDFFile_8.ico F4B0.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\NAPCRYPT.DLL F4B0.tmp File created C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearmhelper.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AGM.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Flash.mpp F4B0.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XDPFile_8.ico F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Annots.api F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ReadOutLoud.api F4B0.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\APIFile_8.ico F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Bib.dll_NON_OPT F4B0.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XFDFFile_8.ico F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrocef.exe.15EE1C08_ED51_465D_B6F3_FB152B1CC435 F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\libcef.dll.15EE1C08_ED51_465D_B6F3_FB152B1CC435 F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\QuickTime.mpp F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\sqlite.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86 F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearm.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\WindowsMedia.mpp F4B0.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SecStoreFile.ico F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll F4B0.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\MCIMPP.mpp F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDF.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Multimedia.api_NON_OPT F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Search.api F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\concrt140.dll_x86 F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Ace.dll_NON_OPT F4B0.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll F4B0.tmp File created C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroForm.api__NON_OPT F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvDX9.x3d F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logsession.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll_Apollo F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\SendMail.api F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adoberfp.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\PPKLite.api F4B0.tmp File created C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86 F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvSOFT.x3d F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EScript.api F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rt3d.dll F4B0.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDXFile_8.ico F4B0.tmp File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SC_Reader.ico F4B0.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100_x86 F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Accessibility.api_NON_OPT F4B0.tmp File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll F4B0.tmp File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDFImpl.dll F4B0.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4448 rundll32.exe 4448 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3152 wrote to memory of 4448 3152 rundll32.exe 85 PID 3152 wrote to memory of 4448 3152 rundll32.exe 85 PID 3152 wrote to memory of 4448 3152 rundll32.exe 85 PID 4448 wrote to memory of 4812 4448 rundll32.exe 87 PID 4448 wrote to memory of 4812 4448 rundll32.exe 87 PID 4448 wrote to memory of 4812 4448 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b530e5b3cb6b6a4e4d9b7c8960f2a2d01fa3221197ef26bbfda4d9813c82707.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b530e5b3cb6b6a4e4d9b7c8960f2a2d01fa3221197ef26bbfda4d9813c82707.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\F4B0.tmpC:\Users\Admin\AppData\Local\Temp\F4B0.tmp3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4812
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5c01e64d77b49ece61d6f6f0cad57367c
SHA18721c167184b5eebe54712347c6751807c0f8510
SHA2566c872a6e325ccd878e5639dd534fa1d41c9114ed48d0f7bdb34a2363c09d0b7d
SHA512f9075db52a43c66c8bbb439958b2c8c40ca22c0f3bf9445f5a8a136dba9d3b6fc14816c72f946b6a6e2a2a1207d5846c2be05089921bac465aec3bc45464da1b
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666