Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 23:08
Static task
static1
Behavioral task
behavioral1
Sample
7daf26e8ee10f8227dbadb227e3907cf9a7148defce19958250925aa057db477.dll
Resource
win7-20240419-en
General
-
Target
7daf26e8ee10f8227dbadb227e3907cf9a7148defce19958250925aa057db477.dll
-
Size
950KB
-
MD5
19c10caa0eb3032d457ec30380767c8c
-
SHA1
2a6c28b92dba01b8e0dc78ac0f53bec4ff9b7c0c
-
SHA256
7daf26e8ee10f8227dbadb227e3907cf9a7148defce19958250925aa057db477
-
SHA512
e483be6d260ac62febf358a4436214a5e4898ff0c5d396147a0a0ae398e0d29b8c3c0b200e2f1ca5276232c97aacb8aa76c33b802d5d47af04d4d51512ab7ba7
-
SSDEEP
24576:THuosyXM4GwPx7S1NSxv9q0AfNXmRyyGBF9nvmWdx:TRs6PI1NGvIfrn+E
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
27FA.tmppid process 1600 27FA.tmp -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid process 2324 rundll32.exe 2324 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
27FA.tmpdescription ioc process File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 27FA.tmp File created C:\Windows\SysWOW64\audiodev.dll 27FA.tmp File created C:\Windows\SysWOW64\FXSXP32.dll 27FA.tmp File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX 27FA.tmp File created C:\Windows\SysWOW64\msltus40.dll 27FA.tmp File opened for modification C:\Windows\SysWOW64\msvcr120_clr0400.dll 27FA.tmp File created C:\Windows\SysWOW64\msxbde40.dll 27FA.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 27FA.tmp File created C:\Windows\SysWOW64\crtdll.dll 27FA.tmp File created C:\Windows\SysWOW64\odbcjt32.dll 27FA.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll 27FA.tmp File created C:\Windows\SysWOW64\ir50_32.dll 27FA.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll 27FA.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll 27FA.tmp File created C:\Windows\SysWOW64\d3dxof.dll 27FA.tmp File created C:\Windows\SysWOW64\dplaysvr.exe 27FA.tmp File created C:\Windows\SysWOW64\dpwsockx.dll 27FA.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll 27FA.tmp File created C:\Windows\SysWOW64\msexcl40.dll 27FA.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 27FA.tmp File created C:\Windows\SysWOW64\mswstr10.dll 27FA.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll 27FA.tmp File created C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll 27FA.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 27FA.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll 27FA.tmp File created C:\Windows\SysWOW64\msjtes40.dll 27FA.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 27FA.tmp File created C:\Windows\SysWOW64\msvbvm60.dll 27FA.tmp File created C:\Windows\SysWOW64\olecli32.dll 27FA.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll 27FA.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 27FA.tmp File created C:\Windows\SysWOW64\msexch40.dll 27FA.tmp File created C:\Windows\SysWOW64\msjter40.dll 27FA.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll 27FA.tmp File created C:\Windows\SysWOW64\msjet40.dll 27FA.tmp File created C:\Windows\SysWOW64\setupSNK.exe 27FA.tmp File created C:\Windows\SysWOW64\InstallShield\setup.exe 27FA.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 27FA.tmp File created C:\Windows\SysWOW64\dmscript.dll 27FA.tmp File created C:\Windows\SysWOW64\ir41_32.ax 27FA.tmp File created C:\Windows\SysWOW64\msorcl32.dll 27FA.tmp File created C:\Windows\SysWOW64\mstext40.dll 27FA.tmp File created C:\Windows\SysWOW64\rdvgumd32.dll 27FA.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 27FA.tmp File created C:\Windows\SysWOW64\msrd2x40.dll 27FA.tmp File created C:\Windows\SysWOW64\regedit.exe 27FA.tmp File opened for modification C:\Windows\SysWOW64\VBAME.DLL 27FA.tmp File created C:\Windows\SysWOW64\dplayx.dll 27FA.tmp File created C:\Windows\SysWOW64\explorer.exe 27FA.tmp File opened for modification C:\Windows\SysWOW64\FM20.DLL 27FA.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 27FA.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 27FA.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll 27FA.tmp File created C:\Windows\SysWOW64\d3dim.dll 27FA.tmp File created C:\Windows\SysWOW64\expsrv.dll 27FA.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll 27FA.tmp File created C:\Windows\SysWOW64\mswdat10.dll 27FA.tmp File created C:\Windows\SysWOW64\ir32_32.dll 27FA.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 27FA.tmp File created C:\Windows\SysWOW64\mfc40.dll 27FA.tmp File created C:\Windows\SysWOW64\mfc40u.dll 27FA.tmp File created C:\Windows\SysWOW64\msrepl40.dll 27FA.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 27FA.tmp File created C:\Windows\SysWOW64\d3dim700.dll 27FA.tmp -
Drops file in Program Files directory 64 IoCs
Processes:
27FA.tmpdescription ioc process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7tkjp.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\OUTLVBA.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll 27FA.tmp File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\pidgenx.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnvpxy.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OARTCONV.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDCAT.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\ColleagueImport.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLMAIL.FAE 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSLID.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKExcel.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SOA.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSCOPY.DLL 27FA.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll 27FA.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api 27FA.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKWord.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPST32.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSVCR71.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ORG97.SAM 27FA.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSCLT.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST64.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHEVI.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMWIN.FAE 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7ES.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXPSRV.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSODCW.DLL 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DESKSAM.SAM 27FA.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ODBC.SAM 27FA.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 27FA.tmp -
Drops file in Windows directory 64 IoCs
Processes:
27FA.tmpdescription ioc process File created C:\Windows\winsxs\x86_microsoft-windows-cryptui-dll_31bf3856ad364e35_6.1.7601.17514_none_87f5c549f6656c22\cryptui.dll 27FA.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUi.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-identitycrl_31bf3856ad364e35_6.1.7600.16385_none_b7d76fe48c7037c5\msidcrl30.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-directxtransforms_31bf3856ad364e35_8.0.7600.16385_none_18ca324046b7d386\dxtrans.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-bwcontexthandler_31bf3856ad364e35_6.1.7600.16385_none_decc6df4e44f2aa3\BWContextHandler.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-drm_31bf3856ad364e35_6.1.7601.17514_none_d6a8cb040fcd3a85\msnetobj.dll 27FA.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_54e0b44114fa502d_aclui.dll_ebee9df6 27FA.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_04dbf9102154d42e_ddraw.dll_8f1f5d02 27FA.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_e24a7886a9947ebf_hdwwiz.exe_b6a1c2df 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPMGR.EXE 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-help-datalayer_31bf3856ad364e35_6.1.7600.16385_none_c490fde17faa7eaa\apds.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-htmlconverter_31bf3856ad364e35_11.2.9600.16428_none_f151276ee40bc690\html.iec 27FA.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.17514_none_8a90facfa04322fd_schannel.dll_7364eaa8 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.2.9600.16428_none_4dd7a0589b288436\webcheck.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-drm_31bf3856ad364e35_6.1.7601.17514_none_d6a8cb040fcd3a85\msscp.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-security-kerberos_31bf3856ad364e35_6.1.7601.17514_none_4f518cecfbcddc34\kerberos.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-directshow-core_31bf3856ad364e35_6.1.7601.17514_none_0eeae7a238e677c8\quartz.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_6.1.7600.16385_none_7b64ef799c494a30\xpsrchvw.exe 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-migration_31bf3856ad364e35_6.1.7600.16385_none_0e3c9ce5e73a7257\imjppdmg.exe 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-f..temutilitylibraries_31bf3856ad364e35_6.1.7601.17514_none_eb9dc1c34def72a3\ifsutil.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-c..complus-runtime-qfe_31bf3856ad364e35_6.1.7600.16385_none_6b3984a4d9e2684a\colbact.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_a69c6a8f23f521f3\diantz.exe 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_6.1.7600.16385_none_73373b169fcf68cb\es.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..siondynamicbinaries_31bf3856ad364e35_6.1.7601.17514_none_f08b571e7ac4826e\compdyn.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-metabase_31bf3856ad364e35_6.1.7601.17514_none_a1aca7966cf36de2\infocomm.dll 27FA.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-riched32_31bf3856ad364e35_6.1.7601.17514_none_9f081dc1e0ddbddb_riched20.dll_fb578f95 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-com-complus-setup_31bf3856ad364e35_6.1.7600.16385_none_e97e2f6c50a1c3c0\commig.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_6.1.7601.17514_none_0d44b8d3df1c79a9\imjpuexc.exe 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-d3dcompiler_31bf3856ad364e35_11.2.9600.16428_none_f5d566eb2d6d9be1\D3DCompiler_47.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728\puiobj.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-rasctrs_31bf3856ad364e35_6.1.7600.16385_none_7a67b4b8c47a30e2\rasctrs.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-video-tvvideocontrol_31bf3856ad364e35_6.1.7601.17514_none_572afa20ce19550c\MSVidCtl.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-g..ppolicy-policymaker_31bf3856ad364e35_6.1.7601.17514_none_39509edea73e0ced\gpprefcl.dll 27FA.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-ole-automation_31bf3856ad364e35_6.1.7601.17514_none_257ada4f467a7f64_oleaut32.dll_730e3d41 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.7601.17514_none_b296f701dc00c582\ieUnatt.exe 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\admwprox.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\migwiz.exe 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-d3d10level9_31bf3856ad364e35_7.1.7601.16492_none_d67de7d188fdee8d\d3d10level9.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-display_31bf3856ad364e35_6.1.7601.17514_none_5a4fc71440f6b083\Display.dll 27FA.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\webengine4.dll 27FA.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-imageanalysis_31bf3856ad364e35_6.1.7601.17514_none_4a6381a588654ba6_dbgeng.dll_eefdd445 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmdl32.exe 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.1.7600.16385_none_81d82fe9c216eb89\pcaui.exe 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-fax-common_31bf3856ad364e35_6.1.7600.16385_none_724e4ae29eb2503d\FXSCOMEX.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\WMIMigrationPlugin.dll 27FA.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-international-core_31bf3856ad364e35_6.1.7601.17514_none_ebb1ce7438031941_muiunattend.exe_1e11bb40 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_61573ee0c2c4be2b\wecutil.exe 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_6.1.7600.16385_none_2831d06e8295c671\upnphost.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_6.1.7600.16385_none_d96243212694b69e\esentutl.exe 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-wmpencen_31bf3856ad364e35_6.1.7601.17514_none_f5404151ef3a5597\WMPEncEn.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-snmp-mgmt-api_31bf3856ad364e35_6.1.7600.16385_none_51d5fb6b0198fa85\mgmtapi.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-devicepairingdll_31bf3856ad364e35_6.1.7600.16385_none_6dd996716463e8a5\DevicePairing.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d10.1_31bf3856ad364e35_6.1.7601.17514_none_5230e75107d43005\d3d10_1.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-e..rformancemonitoring_31bf3856ad364e35_6.1.7600.16385_none_17d2ef5202301871\esentprf.dll 27FA.tmp File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\mssph.dll 27FA.tmp File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\SearchProtocolHost.exe 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..-mmc-usersandgroups_31bf3856ad364e35_6.1.7601.17514_none_05e47e97e02a316a\localsec.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ieframe_31bf3856ad364e35_11.2.9600.16428_none_514e29fff78dfcea\ieframe.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.1.7601.17514_none_1c573e607b725919\PlaMig.dll 27FA.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_9d700972113e2691\setupapi.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directwrite_31bf3856ad364e35_7.1.7601.16492_none_c5bcea40e8da67a0\DWrite.dll 27FA.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_newdev.exe_7eb73dcd 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_6.1.7600.16385_none_1207cf88785de24d\bcryptprimitives.dll 27FA.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..tshow-kernelsupport_31bf3856ad364e35_6.1.7601.17514_none_ea090647f58e5d9c\ksproxy.ax 27FA.tmp -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1752 wrote to memory of 2324 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 2324 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 2324 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 2324 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 2324 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 2324 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 2324 1752 rundll32.exe rundll32.exe PID 2324 wrote to memory of 1600 2324 rundll32.exe 27FA.tmp PID 2324 wrote to memory of 1600 2324 rundll32.exe 27FA.tmp PID 2324 wrote to memory of 1600 2324 rundll32.exe 27FA.tmp PID 2324 wrote to memory of 1600 2324 rundll32.exe 27FA.tmp
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7daf26e8ee10f8227dbadb227e3907cf9a7148defce19958250925aa057db477.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7daf26e8ee10f8227dbadb227e3907cf9a7148defce19958250925aa057db477.dll,#12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmpC:\Users\Admin\AppData\Local\Temp\27FA.tmp3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\27FA.tmpFilesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
memory/2324-0-0x0000000000140000-0x0000000000190000-memory.dmpFilesize
320KB
-
memory/2324-1-0x0000000000140000-0x0000000000190000-memory.dmpFilesize
320KB