Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 23:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1.exe
-
Size
432KB
-
MD5
b472ecd29e2aff2a17ff3d198553b771
-
SHA1
a08c155c6135c45f37a9377eaeeb9c62b0f1b1d8
-
SHA256
7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1
-
SHA512
20d92a4f3680c7bcc490fa5930c0a7242a3dde35f5005db8f57ac4b756e821d8af4d1e3aca2cd1a40ad8200bc404135a81443c7e5818ff85091c82c0da774b9f
-
SSDEEP
6144:nByoHQz+vruV+SM9PagTNFkk+tU5HnWvoBUwfmt21il0DGDHM:ByowzrOPlTgY53fmtgilE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2468 15D2.tmp -
Loads dropped DLL 2 IoCs
pid Process 2340 7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1.exe 2340 7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dpwsockx.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\FM20.DLL 15D2.tmp File created C:\Windows\SysWOW64\ir41_32.ax 15D2.tmp File created C:\Windows\SysWOW64\msjet40.dll 15D2.tmp File created C:\Windows\SysWOW64\msrepl40.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll 15D2.tmp File created C:\Windows\SysWOW64\mswdat10.dll 15D2.tmp File created C:\Windows\SysWOW64\msxbde40.dll 15D2.tmp File created C:\Windows\SysWOW64\dmscript.dll 15D2.tmp File created C:\Windows\SysWOW64\ir50_32.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX 15D2.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll 15D2.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 15D2.tmp File created C:\Windows\SysWOW64\msjter40.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 15D2.tmp File created C:\Windows\SysWOW64\d3d8.dll 15D2.tmp File created C:\Windows\SysWOW64\dplayx.dll 15D2.tmp File created C:\Windows\SysWOW64\ir32_32.dll 15D2.tmp File created C:\Windows\SysWOW64\expsrv.dll 15D2.tmp File created C:\Windows\SysWOW64\mfc40u.dll 15D2.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 15D2.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll 15D2.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll 15D2.tmp File created C:\Windows\SysWOW64\msltus40.dll 15D2.tmp File created C:\Windows\SysWOW64\msrd2x40.dll 15D2.tmp File created C:\Windows\SysWOW64\regedit.exe 15D2.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll 15D2.tmp File created C:\Windows\SysWOW64\d3dxof.dll 15D2.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 15D2.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 15D2.tmp File created C:\Windows\SysWOW64\msjtes40.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\msvcr120_clr0400.dll 15D2.tmp File created C:\Windows\SysWOW64\olecli32.dll 15D2.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll 15D2.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 15D2.tmp File created C:\Windows\SysWOW64\d3dim700.dll 15D2.tmp File created C:\Windows\SysWOW64\FXSXP32.dll 15D2.tmp File created C:\Windows\SysWOW64\mspbde40.dll 15D2.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 15D2.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll 15D2.tmp File created C:\Windows\SysWOW64\crtdll.dll 15D2.tmp File created C:\Windows\SysWOW64\dplaysvr.exe 15D2.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 15D2.tmp File created C:\Windows\SysWOW64\setupSNK.exe 15D2.tmp File created C:\Windows\SysWOW64\mswstr10.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll 15D2.tmp File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 15D2.tmp File created C:\Windows\SysWOW64\audiodev.dll 15D2.tmp File created C:\Windows\SysWOW64\d3dim.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll 15D2.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 15D2.tmp File created C:\Windows\SysWOW64\msexcl40.dll 15D2.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 15D2.tmp File created C:\Windows\SysWOW64\rdvgumd32.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll 15D2.tmp File opened for modification C:\Windows\SysWOW64\VBAME.DLL 15D2.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 15D2.tmp File created C:\Windows\SysWOW64\iac25_32.ax 15D2.tmp File created C:\Windows\SysWOW64\mfc40.dll 15D2.tmp File created C:\Windows\SysWOW64\msexch40.dll 15D2.tmp File created C:\Windows\SysWOW64\msorcl32.dll 15D2.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EntityPicker.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OFFOWC.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLMAPI32.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\TaxonomyControl.dll 15D2.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VVIEWDWG.DLL 15D2.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\VBE7.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_PDF.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\RM.DLL 15D2.tmp File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 15D2.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MCPS.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OMSMAIN.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\MSGR3FR.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceca35.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7EN.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ogalegit.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnOL.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OISGRAPH.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST32.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\OUTLVBA.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\xmlrwbin.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OMSXP32.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\MSCONV97.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdate.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RTFHTML.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLMIME.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONMAIN.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCF.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RECALL.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 15D2.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PNG32.FLT 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\pidgenx.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll 15D2.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 15D2.tmp -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.22091_none_d0d0722c3bb0dc09\acwow64.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..nents-mdac-ado15-rh_31bf3856ad364e35_6.1.7600.16385_none_33ac69f3afeb0325\msadrh15.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.1.7601.17514_none_fb555132edb3cc33\wmpeffects.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ieframe_31bf3856ad364e35_8.0.7601.17514_none_e7d7639870214e02\ieframe.dll 15D2.tmp File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\mssph.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-help-storagelayer_31bf3856ad364e35_6.1.7600.16385_none_de737c19662130e7\apss.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\logman.exe 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-printing-oleprn_31bf3856ad364e35_6.1.7600.16385_none_7afd327dc09634d7\oleprn.dll 15D2.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-s..ty-protectedstorage_31bf3856ad364e35_6.1.7600.16385_none_ae92b0937e708d46_pstorec.dll_b3635d22 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-imapiv2-base_31bf3856ad364e35_6.1.7601.17514_none_2b851fa75da204a8\imapi2.dll 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7601.17514_none_37575b7e71a86712\sidebar.exe 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-n..rity-domain-clients_31bf3856ad364e35_6.1.7601.17514_none_1ce1e5c45077d5f2\ipsmsnap.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-prnfldr_31bf3856ad364e35_6.1.7601.17514_none_de1f63755188e0a2\prnfldr.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_6.1.7601.17514_none_0d6fabd7def3be93\pmcsnap.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wmadmod_31bf3856ad364e35_6.1.7601.17514_none_885655287c3a2a8e\WMADMOD.DLL 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-drm_31bf3856ad364e35_6.1.7601.17514_none_d6a8cb040fcd3a85\wmdrmsdk.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7601.17514_none_e54fbb95e4c3d1bb\advapi32.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-msmq-installer_31bf3856ad364e35_6.1.7601.17514_none_7d190f1e5e76acbc\mqsec.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-diskmanagement-snapin_31bf3856ad364e35_6.1.7600.16385_none_9bd9af572bf6d52b\dmdskmgr.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_6.1.7600.16385_none_d7c180d4bd657495\iscsicpl.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-sort_31bf3856ad364e35_6.1.7600.16385_none_ab9479767ad67fd7\sort.exe 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wmvxencd_31bf3856ad364e35_6.1.7600.16385_none_49662cc79bce21a1\WMVXENCD.DLL 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\acwow64.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directshow-mpeg2_31bf3856ad364e35_6.1.7601.17514_none_b81694890087430f\mpg2splt.ax 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\apds.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-taskmgr_31bf3856ad364e35_6.1.7601.17514_none_16699919077609d2\taskmgr.exe 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPMGR.EXE 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\iisreset.exe 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..s-mdac-odbcconf-dll_31bf3856ad364e35_6.1.7601.17514_none_09e055945403c2af\odbcconf.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..japanese-customizer_31bf3856ad364e35_6.1.7600.16385_none_62bf7575b8541128\imjpcus.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..replication-objects_31bf3856ad364e35_6.1.7601.17514_none_8246a49603d3db37\msjro.dll 15D2.tmp File created C:\Windows\winsxs\x86_wcf-icardagt_exe_31bf3856ad364e35_6.1.7600.16385_none_31ae00ebd2fb34b5\icardagt.exe 15D2.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-metabase_31bf3856ad364e35_6.1.7601.17514_none_a1aca7966cf36de2\infocomm.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrs.exe 15D2.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.Thunk.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_7f0c7a3c17077fce\wextract.exe 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\WinMail.exe 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-opengl-mf_31bf3856ad364e35_6.1.7600.16385_none_cb31c38d7718c1a4\glmf32.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-photometadatahandler_31bf3856ad364e35_6.1.7600.16385_none_ca45b78446d7c978\PhotoMetadataHandler.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-tasklist_31bf3856ad364e35_6.1.7600.16385_none_28198854bba53a00\tasklist.exe 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmvcore_31bf3856ad364e35_6.1.7601.17514_none_0939edb934199a4a\WMVCORE.DLL 15D2.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ipconfig_31bf3856ad364e35_6.1.7600.16385_none_4c104723794237c2\ipconfig.exe 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-t..framework-migration_31bf3856ad364e35_6.1.7600.16385_none_f0c791fc196de3b5\msctfmig.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\NETSTAT.EXE 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_42ee5aff60183c81\iscsium.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-hotpatchinstaller_1122334455667788_6.1.7600.16385_none_750dc60d80902a89\hotpatchins.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\MediaPlayer-DLMigPlugin.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..nents-mdac-sqlunirl_31bf3856ad364e35_6.1.7600.16385_none_3bed0e7fdd8193ca\sqlunirl.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpshell_31bf3856ad364e35_6.1.7601.17514_none_0dcec3a3a390e9bf\wmpshell.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rsaenh-dll_31bf3856ad364e35_6.1.7600.16385_none_5f9d65eb12980e45\rsaenh.dll 15D2.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-f..temutilitylibraries_31bf3856ad364e35_6.1.7601.17514_none_eb9dc1c34def72a3_ifsutil.dll_7d6905f6 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-metabase_31bf3856ad364e35_6.1.7601.17514_none_a1aca7966cf36de2\metadata.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_abd5b433b8ccf7a4\cmiv2.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wpd-legacywmdmapi_31bf3856ad364e35_6.1.7600.16385_none_5980e766d0fe239f\mswmdm.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_6.1.7600.16385_none_2b1523604c99c736\sfc.exe 15D2.tmp File created C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d\msvcr80.dll 15D2.tmp File created C:\Windows\winsxs\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_d2fff1dae966863c\csc.exe 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-installer-engine_31bf3856ad364e35_6.1.7601.17514_none_6bf52decfe850b3d\msi.dll 15D2.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmpbk32.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-cpfilters_31bf3856ad364e35_6.1.7601.17514_none_39725b743c706895\CPFilters.dll 15D2.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-htmlconverter_31bf3856ad364e35_8.0.7601.17514_none_87da61075c9f17a8\html.iec 15D2.tmp -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2468 2340 7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1.exe 29 PID 2340 wrote to memory of 2468 2340 7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1.exe 29 PID 2340 wrote to memory of 2468 2340 7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1.exe 29 PID 2340 wrote to memory of 2468 2340 7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1.exe"C:\Users\Admin\AppData\Local\Temp\7eff43b8a251855274f01d66f8dd427933e3db955dff4247fca975b7decb09f1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmpC:\Users\Admin\AppData\Local\Temp\15D2.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2468
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666