Analysis
-
max time kernel
127s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 22:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7.exe
-
Size
464KB
-
MD5
d401d2f39b5d383c3a3dda0ddd91c939
-
SHA1
913050e949d8838513c7a63f4f3b6e555ad228ab
-
SHA256
5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7
-
SHA512
ac9c0f9080c1f6042d36b952567e602b58b6949d77f54f123f5ec620aa97a8881a84daa67fbd59c8c85571b7fc90eaa9d15a8823ccdc3ce7d68e9c88831e14f2
-
SSDEEP
12288:QDoqjLjglduag46YcBfCYl4z60jjEV0Y:QDrLj4dtcBCT20jAWY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 768 1758.tmp -
Loads dropped DLL 2 IoCs
pid Process 2932 5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7.exe 2932 5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\audiodev.dll 1758.tmp File created C:\Windows\SysWOW64\dmscript.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\FM20.DLL 1758.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll 1758.tmp File created C:\Windows\SysWOW64\mfc40.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll 1758.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll 1758.tmp File created C:\Windows\SysWOW64\crtdll.dll 1758.tmp File created C:\Windows\SysWOW64\expsrv.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX 1758.tmp File created C:\Windows\SysWOW64\mstext40.dll 1758.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll 1758.tmp File created C:\Windows\SysWOW64\d3d8.dll 1758.tmp File created C:\Windows\SysWOW64\dplayx.dll 1758.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 1758.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 1758.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll 1758.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll 1758.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 1758.tmp File created C:\Windows\SysWOW64\FXSXP32.dll 1758.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 1758.tmp File created C:\Windows\SysWOW64\dplaysvr.exe 1758.tmp File created C:\Windows\SysWOW64\ir32_32.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll 1758.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll 1758.tmp File created C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 1758.tmp File created C:\Windows\SysWOW64\msxbde40.dll 1758.tmp File created C:\Windows\SysWOW64\d3dxof.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 1758.tmp File created C:\Windows\SysWOW64\mspbde40.dll 1758.tmp File created C:\Windows\SysWOW64\msexcl40.dll 1758.tmp File created C:\Windows\SysWOW64\msjter40.dll 1758.tmp File created C:\Windows\SysWOW64\regedit.exe 1758.tmp File created C:\Windows\SysWOW64\setupSNK.exe 1758.tmp File created C:\Windows\SysWOW64\iac25_32.ax 1758.tmp File created C:\Windows\SysWOW64\msexch40.dll 1758.tmp File created C:\Windows\SysWOW64\msltus40.dll 1758.tmp File created C:\Windows\SysWOW64\dpwsockx.dll 1758.tmp File created C:\Windows\SysWOW64\msjet40.dll 1758.tmp File created C:\Windows\SysWOW64\msjtes40.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 1758.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 1758.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 1758.tmp File created C:\Windows\SysWOW64\odbcjt32.dll 1758.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll 1758.tmp File created C:\Windows\SysWOW64\ir50_32.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll 1758.tmp File created C:\Windows\SysWOW64\mfc40u.dll 1758.tmp File created C:\Windows\SysWOW64\msvbvm60.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll 1758.tmp File opened for modification C:\Windows\SysWOW64\msvcr120_clr0400.dll 1758.tmp File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 1758.tmp File created C:\Windows\SysWOW64\olecli32.dll 1758.tmp File created C:\Windows\SysWOW64\d3dim700.dll 1758.tmp File created C:\Windows\SysWOW64\explorer.exe 1758.tmp File created C:\Windows\SysWOW64\ir41_32.ax 1758.tmp File created C:\Windows\SysWOW64\msorcl32.dll 1758.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordcnv.dll 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\XLSLICER.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\PAB.SAM 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\Synchronization.dll 1758.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACECORE.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLTASK.FAE 1758.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\WTSP61MS.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLMAIL.FAE 1758.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IETAG.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DBGHELP.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PSTPRX32.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\MSGR3ES.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ORG97.SAM 1758.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia90.dll 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHEV.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHEVI.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORES.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PNG32.FLT 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INLAUNCH.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_PDF.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FBIBLIO.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONTAB32.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCF.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VVIEWER.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FSTOCK.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPOLK.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSSUPP.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER32.DLL 1758.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll 1758.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OARTCONV.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSLIST.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBCONV.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 1758.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MAPIPH.DLL 1758.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPST32.DLL 1758.tmp -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_6.1.7600.16385_none_247621f7aa7542ff\ImagingDevices.exe 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\WMIMigrationPlugin.dll 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\admwprox.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-a..ce-useractionrecord_31bf3856ad364e35_6.1.7600.16385_none_32c4b0bc55387f75\psr.exe 1758.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-ldap-client_31bf3856ad364e35_6.1.7601.17514_none_f543b182b4adcce6_wldap32.dll_09c99dc1 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-msdt_31bf3856ad364e35_6.1.7600.16385_none_0bcbfdec6b984220\msdt.exe 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_32e02520f8081891\WSManHTTPConfig.exe 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d10_31bf3856ad364e35_7.1.7601.16492_none_e2d7e0bdb71755ad\d3d10.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rasmprddm_31bf3856ad364e35_6.1.7601.17514_none_9b1dbb102bda64a1\mprddm.dll 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..siondynamicbinaries_31bf3856ad364e35_6.1.7601.17514_none_f08b571e7ac4826e\compdyn.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-d3d10level9_31bf3856ad364e35_7.1.7601.16492_none_d67de7d188fdee8d\d3d10level9.dll 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mulanttsvoicecommon_31bf3856ad364e35_6.1.7600.16385_none_48330de9affd2c5d\MSTTSDecWrp.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..sql-netlibs-winsock_31bf3856ad364e35_6.1.7600.16385_none_a39b4b21d21ea7b7\dbnetlib.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-msmq-runtime_31bf3856ad364e35_6.1.7601.17514_none_a2e93e679472903c\mqoa.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_6.1.7601.17514_none_8b399e33ba72bed9\twunk_32.exe 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\wet.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_54e0b44114fa502d\aclui.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_6.1.7600.16385_none_d96243212694b69e\esentutl.exe 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-security-credssp_31bf3856ad364e35_6.1.7601.17514_none_c5bf9b5affd21ddc\TSpkg.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wimgapi_31bf3856ad364e35_6.1.7601.17514_none_8b030c557320a2c1\wimserv.exe 1758.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-sqmapi_31bf3856ad364e35_6.1.7601.17514_none_00451cf8631056b6_sqmapi.dll_3755dd17 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPMGR.EXE 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-fax-common_31bf3856ad364e35_6.1.7600.16385_none_724e4ae29eb2503d\FXSAPI.dll 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-msxml30_31bf3856ad364e35_6.1.7601.17514_none_f0e8f05be1d66e78\msxml3.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..olorspaceconverters_31bf3856ad364e35_6.1.7601.17514_none_678c773e0c3c463e\msyuv.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-vgx_31bf3856ad364e35_8.0.7600.16385_none_07c7aec5c1108570\VGX.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-sqmapi_31bf3856ad364e35_6.1.7601.17514_none_00451cf8631056b6\sqmapi.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_6.1.7601.17514_none_8b399e33ba72bed9\twain_32.dll 1758.tmp File created C:\Windows\winsxs\Backup\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.7601.17514_none_83801b5eed6392d9_gdiplus.dll_423f7010 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-international-core_31bf3856ad364e35_6.1.7601.17514_none_ebb1ce7438031941\nlscoremig.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24\newdev.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wpd-shellextension_31bf3856ad364e35_6.1.7601.17514_none_13305696250bcb70\wpdshext.dll 1758.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtilLib.dll 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\WMIADAP.exe 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-bwcontexthandler_31bf3856ad364e35_6.1.7600.16385_none_decc6df4e44f2aa3\BWContextHandler.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-devtools_31bf3856ad364e35_8.0.7601.17514_none_5866bdf3151a6faf\iedvtool.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_6.1.7601.17514_none_88e35d5cb2d54359\net1.exe 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-photoacquire_31bf3856ad364e35_6.1.7601.17514_none_363dce826b046f1f\PhotoAcq.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-unimodem-config_31bf3856ad364e35_6.1.7600.16385_none_f4d7f7b17ffe522a\modemui.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wintrust-dll_31bf3856ad364e35_6.1.7601.17514_none_f1b5a3b0f852fe0e\wintrust.dll 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-t..pc-mathinputcontrol_31bf3856ad364e35_6.1.7600.16385_none_e8a704ebfa319de9\micaut.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.7601.17514_none_83801b5eed6392d9\GdiPlus.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7601.17514_none_d78ad4be6c4ce238\netshell.dll 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\WMIMigrationPlugin.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_95f92198f65d354d\driverquery.exe 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..replication-objects_31bf3856ad364e35_6.1.7601.17514_none_8246a49603d3db37\msjro.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-msmq-installer_31bf3856ad364e35_6.1.7601.17514_none_7d190f1e5e76acbc\mqcmiplugin.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-s..rationmanagement-ui_31bf3856ad364e35_6.1.7600.16385_none_61de21a42805c889\wsecedit.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-unimodem-core-atmini_31bf3856ad364e35_6.1.7601.17514_none_8c361ab5a9718108\unimdmat.dll 1758.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_aeb1ef0f4e6bba1d\wscript.exe 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-calc_31bf3856ad364e35_6.1.7601.17514_none_abc56b2678fe1108\calc.exe 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d_31bf3856ad364e35_6.1.7600.16385_none_eb246466b6cc92e7\d3dim700.dll 1758.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-dui70_31bf3856ad364e35_6.1.7600.16385_none_578b05f45f6e5c68_dui70.dll_5f097b0b 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directshow-capture_31bf3856ad364e35_6.1.7601.17514_none_bae08d1e7dcccf2a\qcap.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_04dbf9102154d42e\ddrawex.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ncrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_5db4abb552efa414\ncrypt.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-printing-oleprn_31bf3856ad364e35_6.1.7600.16385_none_7afd327dc09634d7\oleprn.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_44b0c76c35d4b76d\wab.exe 1758.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-mssign32-dll_31bf3856ad364e35_6.1.7600.16385_none_ca0a23a23bc12926_mssign32.dll_441d133c 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-remotesp_31bf3856ad364e35_6.1.7600.16385_none_aefa4fc5b836c200\remotesp.tsp 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\OEMHelpIns.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-dxptasks-ringtone_31bf3856ad364e35_6.1.7601.17514_none_b0945a7f704488ee\DXPTaskRingtone.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_8.0.7601.17514_none_64655b7c61c841cb\iertutil.dll 1758.tmp File created C:\Windows\winsxs\x86_microsoft-windows-osk_31bf3856ad364e35_6.1.7600.16385_none_aa93298fbb4246f2\osk.exe 1758.tmp -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 768 2932 5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7.exe 28 PID 2932 wrote to memory of 768 2932 5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7.exe 28 PID 2932 wrote to memory of 768 2932 5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7.exe 28 PID 2932 wrote to memory of 768 2932 5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7.exe"C:\Users\Admin\AppData\Local\Temp\5c2615cbfc8e6d2744cf9bffa1e69382d86531a47f09eaccf8e47cebc20484e7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1758.tmpC:\Users\Admin\AppData\Local\Temp\1758.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666