Analysis
-
max time kernel
46s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d36eb8a2368f70285ac680ccd75d8eef.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
d36eb8a2368f70285ac680ccd75d8eef.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
d36eb8a2368f70285ac680ccd75d8eef.exe
-
Size
43KB
-
MD5
d36eb8a2368f70285ac680ccd75d8eef
-
SHA1
3025e48ebc4b3686a97afcf1874e336f2d7e1855
-
SHA256
9ce615c70f0569d634647649cc61be3ec50a8f51b36ba2ffe4942e9a94e5a807
-
SHA512
0915cef66242e864d0b29d406b26c110a97c9fd7b1ef020540c5d11a8761bfae581424d696b6e7cc215749a8ec2422b2886fec14819e715e1bc0e7869fc64407
-
SSDEEP
768:3PJadenAqtYQnaXH96rV2kllriFqR7Atmqfvfj7sMC72ZWzFwKF/KpplC:3PnAClrVLTrEqNAxvXsf7rzV/KpXC
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2184 Kiêm Thê.exe 3004 Kiêm Thê.exe 3000 Kiêm Thê.exe 2676 Kiêm Thê.exe 2856 Kiêm Thê.exe 2580 Kiêm Thê.exe 2728 Kiêm Thê.exe 2648 Kiêm Thê.exe 2372 Kiêm Thê.exe 2568 Kiêm Thê.exe 2460 Kiêm Thê.exe 2512 Kiêm Thê.exe 2932 Kiêm Thê.exe 1804 Kiêm Thê.exe 2944 Kiêm Thê.exe 1228 Kiêm Thê.exe 2764 Kiêm Thê.exe 2788 Kiêm Thê.exe 2812 Kiêm Thê.exe 2920 Kiêm Thê.exe 1424 Kiêm Thê.exe 1672 Kiêm Thê.exe 1944 Kiêm Thê.exe 1948 Kiêm Thê.exe 500 Kiêm Thê.exe 2148 Kiêm Thê.exe 2444 Kiêm Thê.exe 2432 Kiêm Thê.exe 1272 Kiêm Thê.exe 2120 Kiêm Thê.exe 1192 Kiêm Thê.exe 1524 Kiêm Thê.exe 1432 Kiêm Thê.exe 1396 Kiêm Thê.exe 2272 Kiêm Thê.exe 2004 Kiêm Thê.exe 2240 Kiêm Thê.exe 2244 Kiêm Thê.exe 2284 Kiêm Thê.exe 2876 Kiêm Thê.exe 2440 Kiêm Thê.exe 2288 Kiêm Thê.exe 2088 Kiêm Thê.exe 1232 Kiêm Thê.exe 2860 Kiêm Thê.exe 1316 Kiêm Thê.exe 1648 Kiêm Thê.exe 596 Kiêm Thê.exe 780 Kiêm Thê.exe 560 Kiêm Thê.exe 1352 Kiêm Thê.exe 996 Kiêm Thê.exe 1084 Kiêm Thê.exe 1484 Kiêm Thê.exe 1492 Kiêm Thê.exe 3016 Kiêm Thê.exe 1748 Kiêm Thê.exe 2180 Kiêm Thê.exe 1828 Kiêm Thê.exe 1636 Kiêm Thê.exe 836 Kiêm Thê.exe 924 Kiêm Thê.exe 412 Kiêm Thê.exe 2420 Kiêm Thê.exe -
Loads dropped DLL 64 IoCs
pid Process 2008 d36eb8a2368f70285ac680ccd75d8eef.exe 2008 d36eb8a2368f70285ac680ccd75d8eef.exe 2184 Kiêm Thê.exe 2184 Kiêm Thê.exe 3004 Kiêm Thê.exe 3004 Kiêm Thê.exe 3000 Kiêm Thê.exe 3000 Kiêm Thê.exe 2676 Kiêm Thê.exe 2676 Kiêm Thê.exe 2856 Kiêm Thê.exe 2856 Kiêm Thê.exe 2580 Kiêm Thê.exe 2580 Kiêm Thê.exe 2728 Kiêm Thê.exe 2728 Kiêm Thê.exe 2648 Kiêm Thê.exe 2648 Kiêm Thê.exe 2372 Kiêm Thê.exe 2372 Kiêm Thê.exe 2568 Kiêm Thê.exe 2568 Kiêm Thê.exe 2460 Kiêm Thê.exe 2460 Kiêm Thê.exe 2512 Kiêm Thê.exe 2512 Kiêm Thê.exe 2932 Kiêm Thê.exe 2932 Kiêm Thê.exe 1804 Kiêm Thê.exe 1804 Kiêm Thê.exe 2944 Kiêm Thê.exe 2944 Kiêm Thê.exe 1228 Kiêm Thê.exe 1228 Kiêm Thê.exe 2764 Kiêm Thê.exe 2764 Kiêm Thê.exe 2788 Kiêm Thê.exe 2788 Kiêm Thê.exe 2812 Kiêm Thê.exe 2812 Kiêm Thê.exe 2920 Kiêm Thê.exe 2920 Kiêm Thê.exe 1424 Kiêm Thê.exe 1424 Kiêm Thê.exe 1672 Kiêm Thê.exe 1672 Kiêm Thê.exe 1944 Kiêm Thê.exe 1944 Kiêm Thê.exe 1948 Kiêm Thê.exe 1948 Kiêm Thê.exe 500 Kiêm Thê.exe 500 Kiêm Thê.exe 2148 Kiêm Thê.exe 2148 Kiêm Thê.exe 2444 Kiêm Thê.exe 2444 Kiêm Thê.exe 2432 Kiêm Thê.exe 2432 Kiêm Thê.exe 1272 Kiêm Thê.exe 1272 Kiêm Thê.exe 2120 Kiêm Thê.exe 2120 Kiêm Thê.exe 1192 Kiêm Thê.exe 1192 Kiêm Thê.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kiêm Thê = "C:\\Windows\\system32\\Kiêm Thê.exe" Kiêm Thê.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies WinLogon 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Unlock = "WLEUnlock" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logoff = "WLELogoff" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\DllName = "Kiêm Thê.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Startup = "WLEStartup" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Startup = "WLEStartup" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Unlock = "WLEUnlock" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logon = "WLELogon" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Impersonate = "0" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\StartScreenSaver = "WLEStartScreenSaver" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Startup = "WLEStartup" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Impersonate = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Asynchronous = "0" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\StartScreenSaver = "WLEStartScreenSaver" Kiêm Thê.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Unlock = "WLEUnlock" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Unlock = "WLEUnlock" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logon = "WLELogon" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\StartScreenSaver = "WLEStartScreenSaver" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\DllName = "Kiêm Thê.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\DllName = "Kiêm Thê.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê Kiêm Thê.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Asynchronous = "0" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Startup = "WLEStartup" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\DllName = "Kiêm Thê.dll" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\DllName = "Kiêm Thê.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Impersonate = "0" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logoff = "WLELogoff" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Lock = "WLELock" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\StartScreenSaver = "WLEStartScreenSaver" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Lock = "WLELock" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Shutdown = "WLEShutdown" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Startup = "WLEStartup" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Asynchronous = "0" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logoff = "WLELogoff" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\StartScreenSaver = "WLEStartScreenSaver" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\StartScreenSaver = "WLEStartScreenSaver" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Unlock = "WLEUnlock" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\StopScreenSaver = "WLEStopScreenSaver" Kiêm Thê.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Asynchronous = "0" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\StopScreenSaver = "WLEStopScreenSaver" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logon = "WLELogon" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Impersonate = "0" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Startup = "WLEStartup" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Startup = "WLEStartup" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Unlock = "WLEUnlock" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logoff = "WLELogoff" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Shutdown = "WLEShutdown" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logoff = "WLELogoff" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Lock = "WLELock" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logoff = "WLELogoff" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Shutdown = "WLEShutdown" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logoff = "WLELogoff" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\StartScreenSaver = "WLEStartScreenSaver" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Logoff = "WLELogoff" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\Shutdown = "WLEShutdown" Kiêm Thê.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê\StartScreenSaver = "WLEStartScreenSaver" Kiêm Thê.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Kiêm Thê.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Kiêm Thê Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Kiêm Thê.exe File created C:\Windows\SysWOW64\Kiêm Thê.exe Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2184 2008 d36eb8a2368f70285ac680ccd75d8eef.exe 28 PID 2008 wrote to memory of 2184 2008 d36eb8a2368f70285ac680ccd75d8eef.exe 28 PID 2008 wrote to memory of 2184 2008 d36eb8a2368f70285ac680ccd75d8eef.exe 28 PID 2008 wrote to memory of 2184 2008 d36eb8a2368f70285ac680ccd75d8eef.exe 28 PID 2184 wrote to memory of 3004 2184 Kiêm Thê.exe 29 PID 2184 wrote to memory of 3004 2184 Kiêm Thê.exe 29 PID 2184 wrote to memory of 3004 2184 Kiêm Thê.exe 29 PID 2184 wrote to memory of 3004 2184 Kiêm Thê.exe 29 PID 3004 wrote to memory of 3000 3004 Kiêm Thê.exe 30 PID 3004 wrote to memory of 3000 3004 Kiêm Thê.exe 30 PID 3004 wrote to memory of 3000 3004 Kiêm Thê.exe 30 PID 3004 wrote to memory of 3000 3004 Kiêm Thê.exe 30 PID 3000 wrote to memory of 2676 3000 Kiêm Thê.exe 31 PID 3000 wrote to memory of 2676 3000 Kiêm Thê.exe 31 PID 3000 wrote to memory of 2676 3000 Kiêm Thê.exe 31 PID 3000 wrote to memory of 2676 3000 Kiêm Thê.exe 31 PID 2676 wrote to memory of 2856 2676 Kiêm Thê.exe 32 PID 2676 wrote to memory of 2856 2676 Kiêm Thê.exe 32 PID 2676 wrote to memory of 2856 2676 Kiêm Thê.exe 32 PID 2676 wrote to memory of 2856 2676 Kiêm Thê.exe 32 PID 2856 wrote to memory of 2580 2856 Kiêm Thê.exe 33 PID 2856 wrote to memory of 2580 2856 Kiêm Thê.exe 33 PID 2856 wrote to memory of 2580 2856 Kiêm Thê.exe 33 PID 2856 wrote to memory of 2580 2856 Kiêm Thê.exe 33 PID 2580 wrote to memory of 2728 2580 Kiêm Thê.exe 34 PID 2580 wrote to memory of 2728 2580 Kiêm Thê.exe 34 PID 2580 wrote to memory of 2728 2580 Kiêm Thê.exe 34 PID 2580 wrote to memory of 2728 2580 Kiêm Thê.exe 34 PID 2728 wrote to memory of 2648 2728 Kiêm Thê.exe 35 PID 2728 wrote to memory of 2648 2728 Kiêm Thê.exe 35 PID 2728 wrote to memory of 2648 2728 Kiêm Thê.exe 35 PID 2728 wrote to memory of 2648 2728 Kiêm Thê.exe 35 PID 2648 wrote to memory of 2372 2648 Kiêm Thê.exe 36 PID 2648 wrote to memory of 2372 2648 Kiêm Thê.exe 36 PID 2648 wrote to memory of 2372 2648 Kiêm Thê.exe 36 PID 2648 wrote to memory of 2372 2648 Kiêm Thê.exe 36 PID 2372 wrote to memory of 2568 2372 Kiêm Thê.exe 37 PID 2372 wrote to memory of 2568 2372 Kiêm Thê.exe 37 PID 2372 wrote to memory of 2568 2372 Kiêm Thê.exe 37 PID 2372 wrote to memory of 2568 2372 Kiêm Thê.exe 37 PID 2568 wrote to memory of 2460 2568 Kiêm Thê.exe 38 PID 2568 wrote to memory of 2460 2568 Kiêm Thê.exe 38 PID 2568 wrote to memory of 2460 2568 Kiêm Thê.exe 38 PID 2568 wrote to memory of 2460 2568 Kiêm Thê.exe 38 PID 2460 wrote to memory of 2512 2460 Kiêm Thê.exe 39 PID 2460 wrote to memory of 2512 2460 Kiêm Thê.exe 39 PID 2460 wrote to memory of 2512 2460 Kiêm Thê.exe 39 PID 2460 wrote to memory of 2512 2460 Kiêm Thê.exe 39 PID 2512 wrote to memory of 2932 2512 Kiêm Thê.exe 40 PID 2512 wrote to memory of 2932 2512 Kiêm Thê.exe 40 PID 2512 wrote to memory of 2932 2512 Kiêm Thê.exe 40 PID 2512 wrote to memory of 2932 2512 Kiêm Thê.exe 40 PID 2932 wrote to memory of 1804 2932 Kiêm Thê.exe 41 PID 2932 wrote to memory of 1804 2932 Kiêm Thê.exe 41 PID 2932 wrote to memory of 1804 2932 Kiêm Thê.exe 41 PID 2932 wrote to memory of 1804 2932 Kiêm Thê.exe 41 PID 1804 wrote to memory of 2944 1804 Kiêm Thê.exe 42 PID 1804 wrote to memory of 2944 1804 Kiêm Thê.exe 42 PID 1804 wrote to memory of 2944 1804 Kiêm Thê.exe 42 PID 1804 wrote to memory of 2944 1804 Kiêm Thê.exe 42 PID 2944 wrote to memory of 1228 2944 Kiêm Thê.exe 43 PID 2944 wrote to memory of 1228 2944 Kiêm Thê.exe 43 PID 2944 wrote to memory of 1228 2944 Kiêm Thê.exe 43 PID 2944 wrote to memory of 1228 2944 Kiêm Thê.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d36eb8a2368f70285ac680ccd75d8eef.exe"C:\Users\Admin\AppData\Local\Temp\d36eb8a2368f70285ac680ccd75d8eef.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2764 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:500 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1524 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"34⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"35⤵
- Executes dropped EXE
PID:1396 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"36⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"37⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"38⤵
- Executes dropped EXE
PID:2240 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"39⤵
- Executes dropped EXE
PID:2244 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"40⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"41⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"42⤵
- Executes dropped EXE
PID:2440 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"43⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"44⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"45⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1232 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"46⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"47⤵
- Executes dropped EXE
PID:1316 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"48⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"49⤵
- Executes dropped EXE
PID:596 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"50⤵
- Executes dropped EXE
PID:780 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"51⤵
- Executes dropped EXE
PID:560 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"52⤵
- Executes dropped EXE
PID:1352 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"53⤵
- Executes dropped EXE
PID:996 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"54⤵
- Executes dropped EXE
PID:1084 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"55⤵
- Executes dropped EXE
- Modifies WinLogon
PID:1484 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"56⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"57⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1748 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"59⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"60⤵
- Executes dropped EXE
- Modifies WinLogon
PID:1828 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"61⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"62⤵
- Executes dropped EXE
PID:836 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"63⤵
- Executes dropped EXE
PID:924 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"64⤵
- Executes dropped EXE
PID:412 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"65⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"66⤵PID:2428
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"67⤵PID:1052
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"68⤵PID:1152
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"69⤵
- Adds Run key to start application
PID:2132 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"70⤵PID:1384
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"71⤵PID:840
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"72⤵PID:1552
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"73⤵PID:1780
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"74⤵PID:1984
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"75⤵PID:1360
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"76⤵PID:648
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"77⤵PID:1028
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"78⤵PID:1864
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"79⤵PID:2172
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"80⤵PID:1324
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"81⤵PID:920
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"82⤵PID:880
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"83⤵PID:572
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"84⤵PID:2108
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"85⤵PID:2228
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"86⤵PID:2200
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"87⤵PID:344
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"88⤵PID:356
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"89⤵PID:1080
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"90⤵PID:1872
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"91⤵PID:3028
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"92⤵PID:868
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"93⤵PID:2412
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"94⤵PID:2952
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"95⤵PID:3064
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"96⤵PID:1704
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"97⤵PID:1992
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"98⤵PID:1656
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"99⤵PID:1736
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"100⤵PID:1996
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"101⤵PID:2736
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"102⤵PID:1592
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"103⤵PID:1716
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"104⤵PID:2356
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"105⤵PID:2176
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"106⤵PID:1628
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"107⤵PID:2596
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"108⤵PID:2700
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"109⤵PID:2612
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"110⤵PID:3024
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"111⤵PID:2692
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"112⤵PID:2480
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"113⤵PID:2644
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"114⤵PID:1988
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"115⤵PID:2476
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"116⤵PID:2384
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"117⤵
- Adds Run key to start application
PID:2976 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"118⤵PID:1128
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"119⤵PID:1960
-
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"120⤵
- Drops file in System32 directory
PID:2768 -
C:\Windows\SysWOW64\Kiêm Thê.exe"C:\Windows\system32\Kiêm Thê.exe"121⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-