Analysis
- max time kernel
150s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 02:50
Behavioral task
behavioral1
Sample
c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe
- Size 525KB
- Sample240601-dbp9nsfc8z
- SHA256 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af
- MD5 b9fb683cc6860b41de45174bb894af11
- SHA1 4265194c2466bf2c56f0d67e35847f3d6a1a2911
- SHA512 29772a039d4fed9948e1209dce4f70c1e8859ec826f3c9261f4283c7900dca64c94dcd531bdf2c427a2687e1540a9901d822f86a5bee076f6b54ade1b1d4b34c
- SSDEEP 12288:DKZVn2ZkGHKDLLEM+wP82NCNpXDLgf5LPOx/zur5UvKC0ek4CHHb3o:DQ5HEM/HAcmx/mWv9i4kY
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 13 IoCs
resource yara_rule behavioral2/memory/4140-0-0x0000000000400000-0x0000000000444000-memory.dmp UPX behavioral2/memory/5376-1-0x0000000000400000-0x0000000000444000-memory.dmp UPX behavioral2/memory/4552-2-0x0000000000400000-0x0000000000444000-memory.dmp UPX behavioral2/files/0x0005000000022974-5.dat UPX behavioral2/memory/4140-8-0x0000000010000000-0x000000001010B000-memory.dmp UPX behavioral2/memory/4140-9-0x0000000000400000-0x0000000000444000-memory.dmp UPX behavioral2/memory/4140-11-0x0000000010000000-0x000000001010B000-memory.dmp UPX behavioral2/memory/5376-12-0x0000000000400000-0x0000000000444000-memory.dmp UPX behavioral2/memory/4552-13-0x0000000000400000-0x0000000000444000-memory.dmp UPX behavioral2/memory/4848-14-0x0000000000400000-0x0000000000444000-memory.dmp UPX behavioral2/memory/5376-15-0x0000000000400000-0x0000000000444000-memory.dmp UPX behavioral2/memory/4552-17-0x0000000000400000-0x0000000000444000-memory.dmp UPX behavioral2/memory/4848-43-0x0000000000400000-0x0000000000444000-memory.dmp UPX - ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0005000000022974-5.dat acprotect behavioral2/memory/4140-8-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/4140-11-0x0000000010000000-0x000000001010B000-memory.dmp acprotect - Loads dropped DLL 1 IoCs
pid Process 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe -
resource yara_rule behavioral2/memory/4140-0-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/5376-1-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/4552-2-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/files/0x0005000000022974-5.dat upx behavioral2/memory/4140-8-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/4140-9-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/4140-11-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/5376-12-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/4552-13-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/4848-14-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/5376-15-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/4552-17-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/4848-43-0x0000000000400000-0x0000000000444000-memory.dmp upx - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\N: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\E: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\J: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\V: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\L: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\V: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\Q: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\O: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\Q: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\G: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\O: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\T: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\T: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\T: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\X: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\P: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\V: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\U: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\U: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\H: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\J: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\R: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\W: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\Q: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\G: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\M: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\U: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\H: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\E: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\T: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\U: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\E: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\H: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\J: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\V: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\X: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\N: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\X: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\K: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\P: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\I: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\M: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\O: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\L: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\R: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\W: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\I: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\L: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\M: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\P: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\L: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\S: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\K: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\N: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\S: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\G: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\K: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\I: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\K: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\P: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\O: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\W: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe File opened (read-only) \??\G: c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftpdll.dll c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 5376 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 5376 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4552 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4552 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4140 wrote to memory of 5376 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 87 PID 4140 wrote to memory of 5376 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 87 PID 4140 wrote to memory of 5376 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 87 PID 4140 wrote to memory of 4552 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 96 PID 4140 wrote to memory of 4552 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 96 PID 4140 wrote to memory of 4552 4140 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 96 PID 5376 wrote to memory of 4848 5376 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 98 PID 5376 wrote to memory of 4848 5376 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 98 PID 5376 wrote to memory of 4848 5376 c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe"C:\Users\Admin\AppData\Local\Temp\c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exeC:\Users\Admin\AppData\Local\Temp\c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exeC:\Users\Admin\AppData\Local\Temp\c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe3⤵
- Enumerates connected drives
PID:4848
-
-
-
C:\Users\Admin\AppData\Local\Temp\c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exeC:\Users\Admin\AppData\Local\Temp\c20ab736e7aa6efd5e6e2dac86c5ac75dc30951f85d8b7dc18b6d849752ab1af.exe2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:4552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ftpdll.dll
- Size 5KB
- SHA256 1767b9108ac9ba4e5d0a7bb104a3462ec4dd5076d3245ad58d25fd1a972fecd0
- MD5 91d31d186f3bbd935946697f8b34d5a0
- SHA1 78eccbde63c6913759adf819622ebc3508840f94
- SHA512 16bdd3bbf2f51b585617a9d398ce1fa8b997e8dbb92ca2d441cab833733255d364537f1ecf9fa020014af759dc6baf4e1f60bfcdb510062c9ecb01ac64c05db4
- SSDEEP 96:3dNhLNDNx8vu4fYQbNOaVxEJfuzHtbAB/:3dH9Ni2C9OkO0Ht6
- MD5 SHA1 SHA512 SSDEEP