Analysis
-
max time kernel
38s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 12:20
Behavioral task
behavioral1
Sample
9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
120 seconds
Behavioral task
behavioral2
Sample
9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe
-
Size
1.0MB
-
MD5
fc891c1eef8dc297fb88b558218b9700
-
SHA1
15c7f4ce688c9b64f562dd6707de529820f680ad
-
SHA256
9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451
-
SHA512
7880fff1dffacc597d92bc2be17de557fdc7bde0249b048dc227369ea712021de36ae2ab9772be7108726fcd943067a9127750b770ea857da8fda182dd9b554f
-
SSDEEP
24576:LSEN3xtvIjdFpRXF4R6G1Rxb1L1bxLT1Gxb1715xnlGf6fNfl1gvklTY:LNC9Y
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0007000000019261-9.dat family_neshta behavioral1/files/0x000700000001927a-15.dat family_neshta behavioral1/files/0x000f00000001033a-16.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x0013000000010321-17.dat family_neshta behavioral1/memory/2892-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2600-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2056-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2960-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2260-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2036-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1332-108-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/304-107-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-99.dat family_neshta behavioral1/files/0x000100000000f7e6-121.dat family_neshta behavioral1/files/0x000100000000f7ca-120.dat family_neshta behavioral1/files/0x000100000000f776-119.dat family_neshta behavioral1/files/0x000100000000f7d8-118.dat family_neshta behavioral1/memory/580-138-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2268-149-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f703-124.dat family_neshta behavioral1/memory/2520-157-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1960-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2668-193-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2356-185-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1800-183-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/548-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/928-175-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2300-200-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/788-199-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/376-167-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1328-166-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2104-156-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2468-148-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2144-139-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3004-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2156-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1928-228-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1936-229-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2376-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1580-246-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-256-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2712-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3032-266-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-267-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2640-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2492-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1148-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2228-320-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1052-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2216-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1284-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2392-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/644-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1648-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2064-365-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1740-364-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2936 svchost.com 2892 9D2E93~1.EXE 2740 svchost.com 2600 9D2E93~1.EXE 3016 svchost.com 2056 9D2E93~1.EXE 2960 svchost.com 2432 9D2E93~1.EXE 2260 svchost.com 2036 9D2E93~1.EXE 1332 svchost.com 304 9D2E93~1.EXE 2144 svchost.com 580 9D2E93~1.EXE 2468 svchost.com 2268 9D2E93~1.EXE 2520 svchost.com 2104 9D2E93~1.EXE 376 svchost.com 1328 9D2E93~1.EXE 548 svchost.com 928 9D2E93~1.EXE 1800 svchost.com 2356 9D2E93~1.EXE 1960 svchost.com 2668 9D2E93~1.EXE 2300 svchost.com 788 9D2E93~1.EXE 2156 svchost.com 3004 9D2E93~1.EXE 1936 svchost.com 1928 9D2E93~1.EXE 2376 svchost.com 1580 9D2E93~1.EXE 2828 svchost.com 2712 9D2E93~1.EXE 2936 svchost.com 3032 9D2E93~1.EXE 2640 svchost.com 2492 9D2E93~1.EXE 1148 svchost.com 3016 9D2E93~1.EXE 2228 svchost.com 2432 9D2E93~1.EXE 1052 svchost.com 2216 9D2E93~1.EXE 2392 svchost.com 1284 9D2E93~1.EXE 644 svchost.com 1648 9D2E93~1.EXE 1740 svchost.com 2064 9D2E93~1.EXE 2384 svchost.com 2044 9D2E93~1.EXE 476 svchost.com 968 9D2E93~1.EXE 548 svchost.com 848 9D2E93~1.EXE 1788 svchost.com 1960 9D2E93~1.EXE 1660 svchost.com 956 9D2E93~1.EXE 1260 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2076 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2076 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2936 svchost.com 2936 svchost.com 2740 svchost.com 2740 svchost.com 3016 svchost.com 3016 svchost.com 2960 svchost.com 2960 svchost.com 2260 svchost.com 2260 svchost.com 1332 svchost.com 1332 svchost.com 2076 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2144 svchost.com 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2144 svchost.com 2468 svchost.com 2468 svchost.com 2520 svchost.com 2520 svchost.com 376 svchost.com 376 svchost.com 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 548 svchost.com 548 svchost.com 1800 svchost.com 1800 svchost.com 1960 svchost.com 1960 svchost.com 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2300 svchost.com 2300 svchost.com 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2156 svchost.com 2156 svchost.com 1936 svchost.com 1936 svchost.com 2376 svchost.com 2376 svchost.com 2828 svchost.com 2828 svchost.com 2936 svchost.com 2936 svchost.com 2640 svchost.com 2640 svchost.com 1148 svchost.com 1148 svchost.com 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2228 svchost.com 2228 svchost.com 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 1052 svchost.com 1052 svchost.com 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2392 svchost.com 2392 svchost.com 644 svchost.com 644 svchost.com 1740 svchost.com 1740 svchost.com 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2920 9D2E93~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2796 2076 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 30 PID 2076 wrote to memory of 2796 2076 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 30 PID 2076 wrote to memory of 2796 2076 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 30 PID 2076 wrote to memory of 2796 2076 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 30 PID 2796 wrote to memory of 2936 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 67 PID 2796 wrote to memory of 2936 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 67 PID 2796 wrote to memory of 2936 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 67 PID 2796 wrote to memory of 2936 2796 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 67 PID 2936 wrote to memory of 2892 2936 svchost.com 32 PID 2936 wrote to memory of 2892 2936 svchost.com 32 PID 2936 wrote to memory of 2892 2936 svchost.com 32 PID 2936 wrote to memory of 2892 2936 svchost.com 32 PID 2892 wrote to memory of 2740 2892 9D2E93~1.EXE 33 PID 2892 wrote to memory of 2740 2892 9D2E93~1.EXE 33 PID 2892 wrote to memory of 2740 2892 9D2E93~1.EXE 33 PID 2892 wrote to memory of 2740 2892 9D2E93~1.EXE 33 PID 2740 wrote to memory of 2600 2740 svchost.com 34 PID 2740 wrote to memory of 2600 2740 svchost.com 34 PID 2740 wrote to memory of 2600 2740 svchost.com 34 PID 2740 wrote to memory of 2600 2740 svchost.com 34 PID 2600 wrote to memory of 3016 2600 9D2E93~1.EXE 72 PID 2600 wrote to memory of 3016 2600 9D2E93~1.EXE 72 PID 2600 wrote to memory of 3016 2600 9D2E93~1.EXE 72 PID 2600 wrote to memory of 3016 2600 9D2E93~1.EXE 72 PID 3016 wrote to memory of 2056 3016 svchost.com 36 PID 3016 wrote to memory of 2056 3016 svchost.com 36 PID 3016 wrote to memory of 2056 3016 svchost.com 36 PID 3016 wrote to memory of 2056 3016 svchost.com 36 PID 2056 wrote to memory of 2960 2056 9D2E93~1.EXE 37 PID 2056 wrote to memory of 2960 2056 9D2E93~1.EXE 37 PID 2056 wrote to memory of 2960 2056 9D2E93~1.EXE 37 PID 2056 wrote to memory of 2960 2056 9D2E93~1.EXE 37 PID 2960 wrote to memory of 2432 2960 svchost.com 74 PID 2960 wrote to memory of 2432 2960 svchost.com 74 PID 2960 wrote to memory of 2432 2960 svchost.com 74 PID 2960 wrote to memory of 2432 2960 svchost.com 74 PID 2432 wrote to memory of 2260 2432 9D2E93~1.EXE 39 PID 2432 wrote to memory of 2260 2432 9D2E93~1.EXE 39 PID 2432 wrote to memory of 2260 2432 9D2E93~1.EXE 39 PID 2432 wrote to memory of 2260 2432 9D2E93~1.EXE 39 PID 2260 wrote to memory of 2036 2260 svchost.com 119 PID 2260 wrote to memory of 2036 2260 svchost.com 119 PID 2260 wrote to memory of 2036 2260 svchost.com 119 PID 2260 wrote to memory of 2036 2260 svchost.com 119 PID 2036 wrote to memory of 1332 2036 9D2E93~1.EXE 41 PID 2036 wrote to memory of 1332 2036 9D2E93~1.EXE 41 PID 2036 wrote to memory of 1332 2036 9D2E93~1.EXE 41 PID 2036 wrote to memory of 1332 2036 9D2E93~1.EXE 41 PID 1332 wrote to memory of 304 1332 svchost.com 42 PID 1332 wrote to memory of 304 1332 svchost.com 42 PID 1332 wrote to memory of 304 1332 svchost.com 42 PID 1332 wrote to memory of 304 1332 svchost.com 42 PID 304 wrote to memory of 2144 304 9D2E93~1.EXE 43 PID 304 wrote to memory of 2144 304 9D2E93~1.EXE 43 PID 304 wrote to memory of 2144 304 9D2E93~1.EXE 43 PID 304 wrote to memory of 2144 304 9D2E93~1.EXE 43 PID 2144 wrote to memory of 580 2144 svchost.com 44 PID 2144 wrote to memory of 580 2144 svchost.com 44 PID 2144 wrote to memory of 580 2144 svchost.com 44 PID 2144 wrote to memory of 580 2144 svchost.com 44 PID 580 wrote to memory of 2468 580 9D2E93~1.EXE 126 PID 580 wrote to memory of 2468 580 9D2E93~1.EXE 126 PID 580 wrote to memory of 2468 580 9D2E93~1.EXE 126 PID 580 wrote to memory of 2468 580 9D2E93~1.EXE 126
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe"C:\Users\Admin\AppData\Local\Temp\9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE18⤵
- Executes dropped EXE
PID:2268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE20⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE22⤵
- Executes dropped EXE
PID:1328 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE24⤵
- Executes dropped EXE
PID:928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE26⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE28⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE30⤵
- Executes dropped EXE
PID:788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE32⤵
- Executes dropped EXE
PID:3004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE38⤵
- Executes dropped EXE
PID:2712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE40⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE42⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE44⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE46⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE48⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE50⤵
- Executes dropped EXE
PID:1284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE52⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE54⤵
- Executes dropped EXE
PID:2064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"55⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE56⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"59⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE60⤵
- Executes dropped EXE
PID:848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"61⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"63⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE64⤵
- Executes dropped EXE
PID:956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE66⤵PID:2400
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"67⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE68⤵PID:1056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"69⤵
- Drops file in Windows directory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE70⤵PID:1176
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"71⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE72⤵PID:1940
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"73⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE74⤵PID:3040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"75⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE76⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"77⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE78⤵PID:2576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"79⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE80⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"81⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE82⤵PID:2616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"83⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE84⤵PID:2188
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"85⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE86⤵PID:524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"87⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE88⤵PID:1164
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"89⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE90⤵PID:2228
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"91⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE92⤵PID:1932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"93⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE94⤵PID:2148
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"95⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE96⤵PID:1876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"97⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE98⤵
- Drops file in Windows directory
PID:2468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"99⤵
- Drops file in Windows directory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE100⤵
- Drops file in Windows directory
PID:1740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"101⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE102⤵PID:1520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"103⤵
- System Location Discovery: System Language Discovery
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE104⤵PID:2096
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"105⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE106⤵PID:1620
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"107⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE108⤵
- Drops file in Windows directory
PID:1820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"109⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE110⤵PID:2472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"111⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE112⤵PID:2328
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"113⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE114⤵
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"115⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE116⤵PID:2944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"117⤵
- System Location Discovery: System Language Discovery
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE118⤵PID:2992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"119⤵
- Drops file in Windows directory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE120⤵PID:2784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-