Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 18:06
Behavioral task
behavioral1
Sample
0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe
-
Size
348KB
-
MD5
cafdd4962dd00ff3d59b0481bef83c78
-
SHA1
bc9da8b3decb86edfbc3c5eab6ac8c40543ee814
-
SHA256
0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318
-
SHA512
29063753a504f46343c917040de19640751bf47d0e36012e0e5eb18a87c868d6ac6c35faf500e95220578e89a907cff2c6f291f71277ceb72055ee9c6a02b6fb
-
SSDEEP
6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0SX:ouLwoZQGpnedeP/deUe1ppGjTGHZRT0z
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 36 IoCs
resource yara_rule behavioral1/memory/1924-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0008000000017462-11.dat family_gh0strat behavioral1/files/0x000700000001746a-16.dat family_gh0strat behavioral1/memory/1924-26-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0006000000019248-45.dat family_gh0strat behavioral1/memory/2804-49-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1228-57-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001979c-74.dat family_gh0strat behavioral1/memory/3028-88-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1228-80-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0005000000019c4d-103.dat family_gh0strat behavioral1/memory/3028-109-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2420-111-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0005000000019d6d-132.dat family_gh0strat behavioral1/memory/2808-139-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2420-136-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a04b-161.dat family_gh0strat behavioral1/memory/2808-166-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/380-172-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a310-189.dat family_gh0strat behavioral1/memory/380-193-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a425-217.dat family_gh0strat behavioral1/memory/2236-223-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a475-246.dat family_gh0strat behavioral1/memory/1640-260-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1604-281-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1640-278-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1204-252-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1604-300-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2092-306-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/2092-304-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/2092-322-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1592-342-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2776-362-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2404-364-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/2404-383-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5974474B-08FA-4090-907D-97D73D49DDD5} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{38EB9DCC-9D4B-485f-AC95-F2011D981F99} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF9F7F14-AE0A-4b68-BC19-11B10EF74CC1} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{444900AB-39E1-4b0b-89D1-F1E499B67716} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E573CDF4-B4F7-47ca-BAA2-FC8FD0F44D4F} inghxondz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0160BD98-DC40-4d30-8621-8A6289202602} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{41284FCA-BF52-4f52-91EE-76053A6F1A5D} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7DDEEA09-B24B-4073-A3E9-1038CFF439B6} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8EB91BD8-FA0D-49e4-92E1-2A0597549F26}\stubpath = "C:\\Windows\\system32\\inzzjgeaz.exe" ingkycsra.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9E6703CA-439A-49a4-A2D9-DC2412A7AB80} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8E8174A9-AD7F-4869-8282-B85730B42611}\stubpath = "C:\\Windows\\system32\\inhfsogkk.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0AD4447-B81E-4909-BA3C-52F5CC69478B} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6239EA50-189E-488e-913E-504798392662}\stubpath = "C:\\Windows\\system32\\inxwfeaor.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9498A75C-F6E1-4ecb-BDD5-955DD49B380C} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BF7A6E52-39CC-4e3b-A38F-F6A185D97EB3} inuonujxj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{62CF51BF-10CB-4024-B075-06D79650FD8F}\stubpath = "C:\\Windows\\system32\\inwvgwkho.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D70199FB-28D3-4e83-9B36-C1DC75F8FE62} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{88EDD29D-87C4-48a6-B1D2-6AB3771F73F5} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{975C227E-113C-4db2-AB3D-D17D3A802C18}\stubpath = "C:\\Windows\\system32\\inggktmoa.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81DD60AB-49D6-47dd-AF55-F25ACF85A108} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{11C36AC3-6FE5-43a9-BB94-277C68A1EFB2}\stubpath = "C:\\Windows\\system32\\invptshpt.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{662DE561-BD8C-4def-800D-6B700EFE290B} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22D3D30D-E8A0-4579-920C-EECBA73DB74A} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15B78889-DE1A-4e17-997F-34D4AE436973} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D018104F-CA72-4dce-856C-80ED2E316AAE}\stubpath = "C:\\Windows\\system32\\inkycsray.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BE0F8AD4-6CF8-4a82-B142-ACC417E9CBC1}\stubpath = "C:\\Windows\\system32\\inagexpqx.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97E0A3CB-6FED-4f28-8B0C-A45FFA9A8867} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3AADCF00-D488-4648-AB73-560B7EBBC1A5}\stubpath = "C:\\Windows\\system32\\infztsmbn.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ACD9DDD2-0784-4457-A150-D7472D918ACD} inagshjtq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{16593058-D05F-412d-9BB9-FE2D2BD79B6B} intlbygys.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D43B0CCD-A3DF-4c60-B96C-2CC3D4FE9F10} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60CF3B30-8D44-4eab-8745-FF95B1917779} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{11B0B8F2-D963-4c1f-87AF-0A0AA17B6C8C}\stubpath = "C:\\Windows\\system32\\inozovtkg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D8AA43FB-BE66-487f-9E39-CB374176F1E5}\stubpath = "C:\\Windows\\system32\\inytelrkx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8D513A8-737D-4ded-A877-F4F4BD432F76}\stubpath = "C:\\Windows\\system32\\inwtzamwg.exe" inohtsogb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{87B82F44-745F-4d1d-A306-3D785F78B590}\stubpath = "C:\\Windows\\system32\\inrxkwvzh.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC85EA13-F29F-4de1-837D-DF4E10236EEC}\stubpath = "C:\\Windows\\system32\\inftzfqvl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6F3BAF7F-79FE-42a4-A8CA-542377AC9D73}\stubpath = "C:\\Windows\\system32\\injhpghxs.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{868BCBBB-D305-4bfd-B71E-F6E7A1FA5805} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CE868267-9A6D-4cc7-9388-F54729550F42} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B05199C-7E09-4019-9A14-702D97915DF9} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8585DAE8-F54A-4123-BC37-EA3D03ED801C} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4FEF9B07-C297-46da-93B8-3121A9FC328F} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB9911AC-DB7D-4848-B07E-8C9BD1767908}\stubpath = "C:\\Windows\\system32\\inzfpkker.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DD92219A-FD8F-4436-A3AA-E985E397CDD6}\stubpath = "C:\\Windows\\system32\\inmxdfgcg.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D721667-CB57-48df-AD66-7594D80A3AEE} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{027584D4-C5FF-470c-8F24-51D1ED1C0CB2}\stubpath = "C:\\Windows\\system32\\inwskdhbh.exe" indbkovjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{99D4216E-C24B-4b68-AB2B-51CBC838A1F0} indltdckl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9A3124D-A7E6-4b5a-B8F8-0880C8EDFDD6}\stubpath = "C:\\Windows\\system32\\ingvzmksi.exe" inkbaivic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F81F862E-E880-4b2b-943A-728D805150E2} inlvjosms.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D81C8466-A92C-4309-A25E-51BEE3899B6D}\stubpath = "C:\\Windows\\system32\\intojzuff.exe" innqsqpku.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7074EBA-0CEC-47ae-A7E0-EB894DB065B6} insnxovkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25581EDF-8DA8-40a0-9C16-30125838AFBD} insxoqkwb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D21A687-1448-4e6a-BA65-BFC7338473C9}\stubpath = "C:\\Windows\\system32\\inwocchna.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1B419842-128B-49bf-B6C8-24AD29C46B44} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{77B240D4-3F32-4280-8C8B-95D62E6478E8}\stubpath = "C:\\Windows\\system32\\inbmnexcl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F0204DA-5AE8-4f9d-A6B5-94C66D4CD332}\stubpath = "C:\\Windows\\system32\\iniouewgi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{09B157A4-DD36-49f2-AC41-AF9AD8625C49}\stubpath = "C:\\Windows\\system32\\inngbxzqb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{45E67DE3-F55C-4c87-8299-67F9C8D4E005}\stubpath = "C:\\Windows\\system32\\inlofemzm.exe" inmprqjiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C1FFC066-C1E8-4bb2-913E-B5D8900029F3}\stubpath = "C:\\Windows\\system32\\invuwaxma.exe" infsuonoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8594621-40D2-4328-9E85-E997ED93BE1E}\stubpath = "C:\\Windows\\system32\\inxsdoolp.exe" inqrgtvyi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55403396-5F15-4d7f-8B34-4E868B2FC619} indutoqdi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{127A6AD0-CCEA-4bae-B6BC-A3178A7FFBAA} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBC8B16F-C035-42de-AE77-774E7EA8ABCF} Process not Found -
ACProtect 1.3x - 1.4x DLL software 10 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00080000000120ff-3.dat acprotect behavioral1/files/0x0007000000017562-32.dat acprotect behavioral1/files/0x000500000001962c-61.dat acprotect behavioral1/files/0x0005000000019aef-90.dat acprotect behavioral1/files/0x0005000000019c68-117.dat acprotect behavioral1/files/0x003300000001705e-148.dat acprotect behavioral1/files/0x000500000001a08c-176.dat acprotect behavioral1/files/0x000500000001a41b-204.dat acprotect behavioral1/files/0x000500000001a452-233.dat acprotect behavioral1/files/0x000500000001a486-262.dat acprotect -
Executes dropped EXE 64 IoCs
pid Process 2804 indskelwb.exe 1228 inortslka.exe 3028 inruwvobn.exe 2420 innfvgrkz.exe 2808 inyufnzuj.exe 380 insohtodl.exe 2236 inhwoipfi.exe 1204 intpaiupe.exe 1640 inaexuhtj.exe 1604 inkzrlbas.exe 2092 incrjzdkv.exe 1592 inwixlnmf.exe 2776 injyqkarh.exe 2404 inmkxopbr.exe 2828 inecpcnet.exe 2560 ingiuiufd.exe 2908 inxjymong.exe 2788 inilcbjwj.exe 2656 innuocedv.exe 2872 inpbwqegf.exe 872 inadbobmd.exe 2280 inxtemyti.exe 448 incvyzsfr.exe 2520 inxiaqxbm.exe 1008 inldtepix.exe 2456 inrngsnzc.exe 664 inzhuwqpq.exe 1012 insvxwpco.exe 2772 intfuikjc.exe 2564 inqjpgzht.exe 2724 infvypoww.exe 2572 inmprqjiy.exe 2652 inlofemzm.exe 2416 indxawycz.exe 1620 inrdysgih.exe 2644 inetlfmxc.exe 2952 inzvgovkd.exe 2244 inbfyviuk.exe 1872 indhxkwmb.exe 2532 inkivmnpx.exe 1780 inoavpdfe.exe 2100 inbqiycju.exe 2136 indrzpldy.exe 904 incraptug.exe 2796 inwhpwale.exe 2716 inzkcszdo.exe 2592 inpleqlxa.exe 2784 inogwahsa.exe 2572 inuqbjvqf.exe 1668 inatwyxqd.exe 2524 inugvjlkd.exe 2656 ineuxonvv.exe 2732 inzloqpih.exe 2076 inlsmacbt.exe 1052 inwmpgfnn.exe 2528 incanalcr.exe 2928 inaaajueu.exe 700 inwemzvcu.exe 1568 inqrggyxc.exe 1504 insrzztuj.exe 2712 inutvwllh.exe 2584 inazpsjiq.exe 2084 inbqostfv.exe 1228 inhegsgsd.exe -
Loads dropped DLL 64 IoCs
pid Process 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 2804 indskelwb.exe 2804 indskelwb.exe 2804 indskelwb.exe 2804 indskelwb.exe 2804 indskelwb.exe 1228 inortslka.exe 1228 inortslka.exe 1228 inortslka.exe 1228 inortslka.exe 1228 inortslka.exe 3028 inruwvobn.exe 3028 inruwvobn.exe 3028 inruwvobn.exe 3028 inruwvobn.exe 3028 inruwvobn.exe 2420 innfvgrkz.exe 2420 innfvgrkz.exe 2420 innfvgrkz.exe 2420 innfvgrkz.exe 2420 innfvgrkz.exe 2808 inyufnzuj.exe 2808 inyufnzuj.exe 2808 inyufnzuj.exe 2808 inyufnzuj.exe 2808 inyufnzuj.exe 380 insohtodl.exe 380 insohtodl.exe 380 insohtodl.exe 380 insohtodl.exe 380 insohtodl.exe 2236 inhwoipfi.exe 2236 inhwoipfi.exe 2236 inhwoipfi.exe 2236 inhwoipfi.exe 2236 inhwoipfi.exe 1204 intpaiupe.exe 1204 intpaiupe.exe 1204 intpaiupe.exe 1204 intpaiupe.exe 1204 intpaiupe.exe 1640 inaexuhtj.exe 1640 inaexuhtj.exe 1640 inaexuhtj.exe 1640 inaexuhtj.exe 1640 inaexuhtj.exe 1604 inkzrlbas.exe 1604 inkzrlbas.exe 1604 inkzrlbas.exe 1604 inkzrlbas.exe 1604 inkzrlbas.exe 2092 incrjzdkv.exe 2092 incrjzdkv.exe 2092 incrjzdkv.exe 2092 incrjzdkv.exe 2092 incrjzdkv.exe 1592 inwixlnmf.exe 1592 inwixlnmf.exe 1592 inwixlnmf.exe 1592 inwixlnmf.exe 1592 inwixlnmf.exe 2776 injyqkarh.exe 2776 injyqkarh.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\inkjzlnrk.exe inyenhigo.exe File created C:\Windows\SysWOW64\innbtqbfb.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inrawxqox.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inlisltat.exe_lang.ini innycjqwp.exe File opened for modification C:\Windows\SysWOW64\inoavicvg.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inapytoun.exe_lang.ini inkdpokcq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intznpuyh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inlktiefo.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inkqfxtww.exe Process not Found File created C:\Windows\SysWOW64\inwfaehwj.exe Process not Found File created C:\Windows\SysWOW64\injrrjwyx.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat iniuxcykh.exe File opened for modification C:\Windows\SysWOW64\inrbwntbl.exe_lang.ini inowgoknv.exe File opened for modification C:\Windows\SysWOW64\inrsnkwgt.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inmpqgyst.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\ineyuafyv.exe Process not Found File created C:\Windows\SysWOW64\indtyatrn.exe insezthji.exe File created C:\Windows\SysWOW64\inanrwnpj.exe Process not Found File opened for modification C:\Windows\SysWOW64\inifltqxi.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\insrpkoga.exe Process not Found File opened for modification C:\Windows\SysWOW64\inzxyxikv.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inkptkjut.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inlmosntr.exe incpcgxnb.exe File created C:\Windows\SysWOW64\inwrszoqw.exe ingdjrovg.exe File opened for modification C:\Windows\SysWOW64\inafjyakj.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inbbsecgr.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inadddkrk.exe Process not Found File created C:\Windows\SysWOW64\inmidwzex.exe Process not Found File opened for modification C:\Windows\SysWOW64\ingqbfqbn.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inhlazdts.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invlhtipl.exe File created C:\Windows\SysWOW64\inbkefydl.exe inclpwksm.exe File opened for modification C:\Windows\SysWOW64\inkjlashj.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inxhufoii.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat ingfvhjng.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inodmimko.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\infcwglex.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inmyuihpb.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\ingtggigu.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\indkgfezw.exe_lang.ini inyrmomgz.exe File opened for modification C:\Windows\SysWOW64\invtfsnjp.exe_lang.ini inwezaozq.exe File opened for modification C:\Windows\SysWOW64\invawifmu.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inldxcxou.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\injgscptp.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\invbviubu.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inghxondz.exe_lang.ini injfqeotx.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 2804 indskelwb.exe 1228 inortslka.exe 3028 inruwvobn.exe 2420 innfvgrkz.exe 2808 inyufnzuj.exe 380 insohtodl.exe 2236 inhwoipfi.exe 1204 intpaiupe.exe 1640 inaexuhtj.exe 1604 inkzrlbas.exe 2092 incrjzdkv.exe 1592 inwixlnmf.exe 2776 injyqkarh.exe 2404 inmkxopbr.exe 2828 inecpcnet.exe 2560 ingiuiufd.exe 2908 inxjymong.exe 2788 inilcbjwj.exe 2656 innuocedv.exe 2872 inpbwqegf.exe 872 inadbobmd.exe 2280 inxtemyti.exe 448 incvyzsfr.exe 2520 inxiaqxbm.exe 1008 inldtepix.exe 2456 inrngsnzc.exe 664 inzhuwqpq.exe 1012 insvxwpco.exe 2772 intfuikjc.exe 2564 inqjpgzht.exe 2724 infvypoww.exe 2572 inmprqjiy.exe 2652 inlofemzm.exe 2416 indxawycz.exe 1620 inrdysgih.exe 2644 inetlfmxc.exe 2952 inzvgovkd.exe 2244 inbfyviuk.exe 1872 indhxkwmb.exe 2532 inkivmnpx.exe 1780 inoavpdfe.exe 2100 inbqiycju.exe 2136 indrzpldy.exe 904 incraptug.exe 2796 inwhpwale.exe 2716 inzkcszdo.exe 2592 inpleqlxa.exe 2784 inogwahsa.exe 2572 inuqbjvqf.exe 1668 inatwyxqd.exe 2524 inugvjlkd.exe 2656 ineuxonvv.exe 2732 inzloqpih.exe 2076 inlsmacbt.exe 1052 inwmpgfnn.exe 2528 incanalcr.exe 2928 inaaajueu.exe 700 inwemzvcu.exe 1568 inqrggyxc.exe 1504 insrzztuj.exe 2712 inutvwllh.exe 2584 inazpsjiq.exe 2084 inbqostfv.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe Token: SeDebugPrivilege 2804 indskelwb.exe Token: SeDebugPrivilege 1228 inortslka.exe Token: SeDebugPrivilege 3028 inruwvobn.exe Token: SeDebugPrivilege 2420 innfvgrkz.exe Token: SeDebugPrivilege 2808 inyufnzuj.exe Token: SeDebugPrivilege 380 insohtodl.exe Token: SeDebugPrivilege 2236 inhwoipfi.exe Token: SeDebugPrivilege 1204 intpaiupe.exe Token: SeDebugPrivilege 1640 inaexuhtj.exe Token: SeDebugPrivilege 1604 inkzrlbas.exe Token: SeDebugPrivilege 2092 incrjzdkv.exe Token: SeDebugPrivilege 1592 inwixlnmf.exe Token: SeDebugPrivilege 2776 injyqkarh.exe Token: SeDebugPrivilege 2404 inmkxopbr.exe Token: SeDebugPrivilege 2828 inecpcnet.exe Token: SeDebugPrivilege 2560 ingiuiufd.exe Token: SeDebugPrivilege 2908 inxjymong.exe Token: SeDebugPrivilege 2788 inilcbjwj.exe Token: SeDebugPrivilege 2656 innuocedv.exe Token: SeDebugPrivilege 2872 inpbwqegf.exe Token: SeDebugPrivilege 872 inadbobmd.exe Token: SeDebugPrivilege 2280 inxtemyti.exe Token: SeDebugPrivilege 448 incvyzsfr.exe Token: SeDebugPrivilege 2520 inxiaqxbm.exe Token: SeDebugPrivilege 1008 inldtepix.exe Token: SeDebugPrivilege 2456 inrngsnzc.exe Token: SeDebugPrivilege 664 inzhuwqpq.exe Token: SeDebugPrivilege 1012 insvxwpco.exe Token: SeDebugPrivilege 2772 intfuikjc.exe Token: SeDebugPrivilege 2564 inqjpgzht.exe Token: SeDebugPrivilege 2724 infvypoww.exe Token: SeDebugPrivilege 2572 inmprqjiy.exe Token: SeDebugPrivilege 2652 inlofemzm.exe Token: SeDebugPrivilege 2416 indxawycz.exe Token: SeDebugPrivilege 1620 inrdysgih.exe Token: SeDebugPrivilege 2644 inetlfmxc.exe Token: SeDebugPrivilege 2952 inzvgovkd.exe Token: SeDebugPrivilege 2244 inbfyviuk.exe Token: SeDebugPrivilege 1872 indhxkwmb.exe Token: SeDebugPrivilege 2532 inkivmnpx.exe Token: SeDebugPrivilege 1780 inoavpdfe.exe Token: SeDebugPrivilege 2100 inbqiycju.exe Token: SeDebugPrivilege 2136 indrzpldy.exe Token: SeDebugPrivilege 904 incraptug.exe Token: SeDebugPrivilege 2796 inwhpwale.exe Token: SeDebugPrivilege 2716 inzkcszdo.exe Token: SeDebugPrivilege 2592 inpleqlxa.exe Token: SeDebugPrivilege 2784 inogwahsa.exe Token: SeDebugPrivilege 2572 inuqbjvqf.exe Token: SeDebugPrivilege 1668 inatwyxqd.exe Token: SeDebugPrivilege 2524 inugvjlkd.exe Token: SeDebugPrivilege 2656 ineuxonvv.exe Token: SeDebugPrivilege 2732 inzloqpih.exe Token: SeDebugPrivilege 2076 inlsmacbt.exe Token: SeDebugPrivilege 1052 inwmpgfnn.exe Token: SeDebugPrivilege 2528 incanalcr.exe Token: SeDebugPrivilege 2928 inaaajueu.exe Token: SeDebugPrivilege 700 inwemzvcu.exe Token: SeDebugPrivilege 1568 inqrggyxc.exe Token: SeDebugPrivilege 1504 insrzztuj.exe Token: SeDebugPrivilege 2712 inutvwllh.exe Token: SeDebugPrivilege 2584 inazpsjiq.exe Token: SeDebugPrivilege 2084 inbqostfv.exe -
Suspicious use of SetWindowsHookEx 29 IoCs
pid Process 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 2804 indskelwb.exe 1228 inortslka.exe 3028 inruwvobn.exe 2420 innfvgrkz.exe 2808 inyufnzuj.exe 380 insohtodl.exe 2236 inhwoipfi.exe 1204 intpaiupe.exe 1640 inaexuhtj.exe 1604 inkzrlbas.exe 2092 incrjzdkv.exe 1592 inwixlnmf.exe 2776 injyqkarh.exe 2404 inmkxopbr.exe 2828 inecpcnet.exe 2560 ingiuiufd.exe 2908 inxjymong.exe 2788 inilcbjwj.exe 2656 innuocedv.exe 2872 inpbwqegf.exe 872 inadbobmd.exe 2280 inxtemyti.exe 448 incvyzsfr.exe 2520 inxiaqxbm.exe 1008 inldtepix.exe 2456 inrngsnzc.exe 664 inzhuwqpq.exe 1012 insvxwpco.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2804 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 31 PID 1924 wrote to memory of 2804 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 31 PID 1924 wrote to memory of 2804 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 31 PID 1924 wrote to memory of 2804 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 31 PID 1924 wrote to memory of 2804 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 31 PID 1924 wrote to memory of 2804 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 31 PID 1924 wrote to memory of 2804 1924 0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe 31 PID 2804 wrote to memory of 1228 2804 indskelwb.exe 32 PID 2804 wrote to memory of 1228 2804 indskelwb.exe 32 PID 2804 wrote to memory of 1228 2804 indskelwb.exe 32 PID 2804 wrote to memory of 1228 2804 indskelwb.exe 32 PID 2804 wrote to memory of 1228 2804 indskelwb.exe 32 PID 2804 wrote to memory of 1228 2804 indskelwb.exe 32 PID 2804 wrote to memory of 1228 2804 indskelwb.exe 32 PID 1228 wrote to memory of 3028 1228 inortslka.exe 33 PID 1228 wrote to memory of 3028 1228 inortslka.exe 33 PID 1228 wrote to memory of 3028 1228 inortslka.exe 33 PID 1228 wrote to memory of 3028 1228 inortslka.exe 33 PID 1228 wrote to memory of 3028 1228 inortslka.exe 33 PID 1228 wrote to memory of 3028 1228 inortslka.exe 33 PID 1228 wrote to memory of 3028 1228 inortslka.exe 33 PID 3028 wrote to memory of 2420 3028 inruwvobn.exe 34 PID 3028 wrote to memory of 2420 3028 inruwvobn.exe 34 PID 3028 wrote to memory of 2420 3028 inruwvobn.exe 34 PID 3028 wrote to memory of 2420 3028 inruwvobn.exe 34 PID 3028 wrote to memory of 2420 3028 inruwvobn.exe 34 PID 3028 wrote to memory of 2420 3028 inruwvobn.exe 34 PID 3028 wrote to memory of 2420 3028 inruwvobn.exe 34 PID 2420 wrote to memory of 2808 2420 innfvgrkz.exe 35 PID 2420 wrote to memory of 2808 2420 innfvgrkz.exe 35 PID 2420 wrote to memory of 2808 2420 innfvgrkz.exe 35 PID 2420 wrote to memory of 2808 2420 innfvgrkz.exe 35 PID 2420 wrote to memory of 2808 2420 innfvgrkz.exe 35 PID 2420 wrote to memory of 2808 2420 innfvgrkz.exe 35 PID 2420 wrote to memory of 2808 2420 innfvgrkz.exe 35 PID 2808 wrote to memory of 380 2808 inyufnzuj.exe 36 PID 2808 wrote to memory of 380 2808 inyufnzuj.exe 36 PID 2808 wrote to memory of 380 2808 inyufnzuj.exe 36 PID 2808 wrote to memory of 380 2808 inyufnzuj.exe 36 PID 2808 wrote to memory of 380 2808 inyufnzuj.exe 36 PID 2808 wrote to memory of 380 2808 inyufnzuj.exe 36 PID 2808 wrote to memory of 380 2808 inyufnzuj.exe 36 PID 380 wrote to memory of 2236 380 insohtodl.exe 37 PID 380 wrote to memory of 2236 380 insohtodl.exe 37 PID 380 wrote to memory of 2236 380 insohtodl.exe 37 PID 380 wrote to memory of 2236 380 insohtodl.exe 37 PID 380 wrote to memory of 2236 380 insohtodl.exe 37 PID 380 wrote to memory of 2236 380 insohtodl.exe 37 PID 380 wrote to memory of 2236 380 insohtodl.exe 37 PID 2236 wrote to memory of 1204 2236 inhwoipfi.exe 38 PID 2236 wrote to memory of 1204 2236 inhwoipfi.exe 38 PID 2236 wrote to memory of 1204 2236 inhwoipfi.exe 38 PID 2236 wrote to memory of 1204 2236 inhwoipfi.exe 38 PID 2236 wrote to memory of 1204 2236 inhwoipfi.exe 38 PID 2236 wrote to memory of 1204 2236 inhwoipfi.exe 38 PID 2236 wrote to memory of 1204 2236 inhwoipfi.exe 38 PID 1204 wrote to memory of 1640 1204 intpaiupe.exe 39 PID 1204 wrote to memory of 1640 1204 intpaiupe.exe 39 PID 1204 wrote to memory of 1640 1204 intpaiupe.exe 39 PID 1204 wrote to memory of 1640 1204 intpaiupe.exe 39 PID 1204 wrote to memory of 1640 1204 intpaiupe.exe 39 PID 1204 wrote to memory of 1640 1204 intpaiupe.exe 39 PID 1204 wrote to memory of 1640 1204 intpaiupe.exe 39 PID 1640 wrote to memory of 1604 1640 inaexuhtj.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe"C:\Users\Admin\AppData\Local\Temp\0139422358150eda3958945b70568121b7037e50a0968e2a1c978f7c309aa318.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1604 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1592 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2776 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2404 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2828 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2560 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2908 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2788 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2872 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:872 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2280 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:448 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2520 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1008 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2456 -
C:\Windows\SysWOW64\inzhuwqpq.exeC:\Windows\system32\inzhuwqpq.exe28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:664 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1012 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe32⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe33⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe34⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe36⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe38⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe40⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872 -
C:\Windows\SysWOW64\inkivmnpx.exeC:\Windows\system32\inkivmnpx.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe42⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100 -
C:\Windows\SysWOW64\indrzpldy.exeC:\Windows\system32\indrzpldy.exe44⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136 -
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe46⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe48⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe50⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe52⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe54⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe56⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528 -
C:\Windows\SysWOW64\inaaajueu.exeC:\Windows\system32\inaaajueu.exe58⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Windows\SysWOW64\inwemzvcu.exeC:\Windows\system32\inwemzvcu.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700 -
C:\Windows\SysWOW64\inqrggyxc.exeC:\Windows\system32\inqrggyxc.exe60⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe62⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe64⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe65⤵
- Executes dropped EXE
PID:1228 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe66⤵PID:2888
-
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe67⤵PID:2032
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe68⤵PID:1936
-
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe69⤵PID:1900
-
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe70⤵PID:2192
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe71⤵PID:112
-
C:\Windows\SysWOW64\inrfvkmdx.exeC:\Windows\system32\inrfvkmdx.exe72⤵PID:2260
-
C:\Windows\SysWOW64\invqlwhhe.exeC:\Windows\system32\invqlwhhe.exe73⤵PID:1884
-
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe74⤵PID:1544
-
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe75⤵PID:1200
-
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe76⤵
- Drops file in System32 directory
PID:700 -
C:\Windows\SysWOW64\inghxondz.exeC:\Windows\system32\inghxondz.exe77⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2696 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe78⤵PID:1012
-
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe79⤵PID:2768
-
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe80⤵PID:2720
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe81⤵PID:2080
-
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe82⤵PID:2724
-
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe83⤵PID:3036
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe84⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2436 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe85⤵PID:576
-
C:\Windows\SysWOW64\infsuonoj.exeC:\Windows\system32\infsuonoj.exe86⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1904 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe87⤵PID:1576
-
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe88⤵PID:1836
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe89⤵PID:2820
-
C:\Windows\SysWOW64\invirzkie.exeC:\Windows\system32\invirzkie.exe90⤵PID:1004
-
C:\Windows\SysWOW64\inuydrpyf.exeC:\Windows\system32\inuydrpyf.exe91⤵PID:2060
-
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe92⤵PID:1548
-
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe93⤵PID:1664
-
C:\Windows\SysWOW64\inrxixhwa.exeC:\Windows\system32\inrxixhwa.exe94⤵PID:2208
-
C:\Windows\SysWOW64\inasgqvzt.exeC:\Windows\system32\inasgqvzt.exe95⤵PID:2196
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe96⤵PID:1644
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe97⤵PID:3000
-
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe98⤵PID:2316
-
C:\Windows\SysWOW64\innoddvuk.exeC:\Windows\system32\innoddvuk.exe99⤵PID:2464
-
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe100⤵PID:2776
-
C:\Windows\SysWOW64\inzhpyfbx.exeC:\Windows\system32\inzhpyfbx.exe101⤵PID:2716
-
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe102⤵PID:2588
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe103⤵PID:1408
-
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe104⤵PID:2428
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe105⤵PID:920
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe106⤵PID:2788
-
C:\Windows\SysWOW64\invlbrhjx.exeC:\Windows\system32\invlbrhjx.exe107⤵PID:1940
-
C:\Windows\SysWOW64\inovtknpq.exeC:\Windows\system32\inovtknpq.exe108⤵PID:1264
-
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe109⤵PID:2860
-
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe110⤵PID:1740
-
C:\Windows\SysWOW64\injrhdzvq.exeC:\Windows\system32\injrhdzvq.exe111⤵PID:404
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe112⤵PID:1320
-
C:\Windows\SysWOW64\inzkzjyci.exeC:\Windows\system32\inzkzjyci.exe113⤵PID:336
-
C:\Windows\SysWOW64\inatybwnb.exeC:\Windows\system32\inatybwnb.exe114⤵PID:1436
-
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe115⤵PID:1672
-
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe116⤵PID:2056
-
C:\Windows\SysWOW64\inbohznex.exeC:\Windows\system32\inbohznex.exe117⤵PID:2928
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe118⤵PID:316
-
C:\Windows\SysWOW64\inytozkkh.exeC:\Windows\system32\inytozkkh.exe119⤵PID:2332
-
C:\Windows\SysWOW64\intmsjkwc.exeC:\Windows\system32\intmsjkwc.exe120⤵PID:2672
-
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe121⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-