Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2023, 15:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe
Resource
win7-20231023-en
windows7-x64
8 signatures
150 seconds
General
-
Target
016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe
-
Size
33KB
-
MD5
0130f5e8ec6493e42aaa329210e164e8
-
SHA1
a6a69e3bb0e1aab22a30f7e7bdf281fb25f26b25
-
SHA256
016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd
-
SHA512
9143e3a7b16c1e013ed6e3103c769f8ef8e17ba1c375a5adc25af276751f3c7bda02f6c3a11d92d419117426982259b452c27d4edfdbf848200be7250c90cd0b
-
SSDEEP
768:2QElOIEvzMXqtwp/lttaL7HP4EUi91acSWGoYoLVCm1:2QaYzMXqtGNttyeiZnZLYm1
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\S: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\Q: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\M: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\L: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\X: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\U: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\R: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\K: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\H: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\Y: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\P: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\O: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\I: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\G: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\W: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\V: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\T: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\N: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\J: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened (read-only) \??\E: 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files\Windows Defender\ja-JP\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files\VideoLAN\VLC\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\_desktop.ini 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rundl132.exe 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe File created C:\Windows\Dll.dll 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2116 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 88 PID 1652 wrote to memory of 2116 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 88 PID 1652 wrote to memory of 2116 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 88 PID 2116 wrote to memory of 4496 2116 net.exe 90 PID 2116 wrote to memory of 4496 2116 net.exe 90 PID 2116 wrote to memory of 4496 2116 net.exe 90 PID 1652 wrote to memory of 3804 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 92 PID 1652 wrote to memory of 3804 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 92 PID 1652 wrote to memory of 3804 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 92 PID 3804 wrote to memory of 4092 3804 net.exe 94 PID 3804 wrote to memory of 4092 3804 net.exe 94 PID 3804 wrote to memory of 4092 3804 net.exe 94 PID 1652 wrote to memory of 3312 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 68 PID 1652 wrote to memory of 3312 1652 016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe 68
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe"C:\Users\Admin\AppData\Local\Temp\016217239854bb8d575957b1daf7d47765c1da2b28d0ccb274fa3c53112a17dd.exe"2⤵
- Drops file in Drivers directory
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4496
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4092
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5f59f3ad72aa4868a7f8fd08637ef4c96
SHA1d289cd3f7719e31f8b022f34c11aae0ccfb53d75
SHA256a2eb008ef426694dff89113c6db5e99da73faaf42cef72d98cd846630eca6c17
SHA512a799156352ed73593136b2ce42889dcc162edbc30937d41cabee7f7af5281e3340683e036906e86b9ecfd262de3a5d38ac4c2f09034db8c8c6cf616710917223
-
Filesize
2.8MB
MD5f400c65b3131584703d262d796167b52
SHA14101fc544bc431cba7f8cbca808eb840a0fb44ca
SHA256660112a8066926999226e2eee93b956bbcf2401574aadbb53a6ae4b29bb52da0
SHA51251d3b77b5a75210edf2a66457abdd661875c1de243b9fb776a064d6ebb893464a4745a81f030f8d0b86d47e123d684a8318ca60401932aa02e7a44f1dab7113b
-
Filesize
478KB
MD5209d4b4455ac36ef36cc724e5197edbc
SHA134e806224bfc6ba8bf2dc65386e8268beb4bf0d7
SHA256fa30aab2b90ead118dcb84ca237a9c913893398bdf9099d1f5f859b831f3ae29
SHA5123da50973bb1ecbec2f1d1e4bdb1634a4a94f8bbb4694afd2c01660e51033b40802354cefa84361656ca788be80b59c46fe137ea0577ec93914d0586cdd070144
-
Filesize
10B
MD50d897ff63d6d70834691031400f75fba
SHA11527f718ccce51339d233a1a409fbc4a27fe73d6
SHA2564ae6beff7729c454ddd8204bac0ebeaf452455e43ffb2e7e6fef227f1ad09169
SHA5126cdd19fa414b78c81ac442e75cb85fc7ec97444b80373cd4de0ca20b72f7a6a474589d44202ab04d7a493f2c202ab60951c51d031a4ff95f5a878fa93039794d