Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 12:30
Behavioral task
behavioral1
Sample
9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe
-
Size
1.0MB
-
MD5
fc891c1eef8dc297fb88b558218b9700
-
SHA1
15c7f4ce688c9b64f562dd6707de529820f680ad
-
SHA256
9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451
-
SHA512
7880fff1dffacc597d92bc2be17de557fdc7bde0249b048dc227369ea712021de36ae2ab9772be7108726fcd943067a9127750b770ea857da8fda182dd9b554f
-
SSDEEP
24576:LSEN3xtvIjdFpRXF4R6G1Rxb1L1bxLT1Gxb1715xnlGf6fNfl1gvklTY:LNC9Y
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000015d6d-2.dat family_neshta behavioral1/files/0x0008000000015d75-15.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x0013000000010321-17.dat family_neshta behavioral1/files/0x005e000000010323-16.dat family_neshta behavioral1/memory/1828-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/820-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2788-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2676-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2944-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2824-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d2-84.dat family_neshta behavioral1/memory/2620-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2752-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f775-87.dat family_neshta behavioral1/files/0x000100000000f702-106.dat family_neshta behavioral1/memory/3012-97-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1180-96-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f82c-111.dat family_neshta behavioral1/files/0x000100000000f82d-114.dat family_neshta behavioral1/memory/1800-121-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1656-120-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f871-116.dat family_neshta behavioral1/files/0x0001000000010361-137.dat family_neshta behavioral1/files/0x0001000000010c12-140.dat family_neshta behavioral1/memory/2016-147-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/840-148-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2684-156-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-155-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2468-170-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/880-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2028-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2024-189-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/660-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1608-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/844-207-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3064-206-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2324-221-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1300-222-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1168-236-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2252-234-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/904-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1588-256-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2052-272-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2096-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2796-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2804-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2824-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-313-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2660-314-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1472-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/764-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2644-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2116-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1884-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1892-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/700-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1044-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2904-361-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1384-360-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 820 svchost.com 1828 9D2E93~1.EXE 2676 svchost.com 2788 9D2E93~1.EXE 2944 svchost.com 2824 9D2E93~1.EXE 2620 svchost.com 2752 9D2E93~1.EXE 3012 svchost.com 1180 9D2E93~1.EXE 1800 svchost.com 1656 9D2E93~1.EXE 840 svchost.com 2016 9D2E93~1.EXE 2684 svchost.com 2432 9D2E93~1.EXE 2468 svchost.com 880 9D2E93~1.EXE 2024 svchost.com 2028 9D2E93~1.EXE 1608 svchost.com 660 9D2E93~1.EXE 844 svchost.com 3064 9D2E93~1.EXE 1300 svchost.com 2324 9D2E93~1.EXE 1168 svchost.com 2252 9D2E93~1.EXE 904 svchost.com 1588 9D2E93~1.EXE 2052 svchost.com 3016 9D2E93~1.EXE 2096 svchost.com 2796 9D2E93~1.EXE 2804 svchost.com 2740 9D2E93~1.EXE 2936 svchost.com 2824 9D2E93~1.EXE 2608 svchost.com 2660 9D2E93~1.EXE 1472 svchost.com 764 9D2E93~1.EXE 2644 svchost.com 2116 9D2E93~1.EXE 1884 svchost.com 1892 9D2E93~1.EXE 700 svchost.com 1044 9D2E93~1.EXE 1384 svchost.com 2904 9D2E93~1.EXE 2680 svchost.com 1908 9D2E93~1.EXE 1148 svchost.com 2240 9D2E93~1.EXE 2188 svchost.com 1124 9D2E93~1.EXE 2304 svchost.com 836 9D2E93~1.EXE 584 svchost.com 2024 9D2E93~1.EXE 1748 svchost.com 1876 9D2E93~1.EXE 1972 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 1940 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 1940 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 820 svchost.com 820 svchost.com 2676 svchost.com 2676 svchost.com 2944 svchost.com 2944 svchost.com 2620 svchost.com 2620 svchost.com 3012 svchost.com 3012 svchost.com 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 1940 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 1800 svchost.com 1800 svchost.com 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 840 svchost.com 840 svchost.com 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2684 svchost.com 2684 svchost.com 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2468 svchost.com 2468 svchost.com 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2024 svchost.com 2024 svchost.com 1608 svchost.com 1608 svchost.com 844 svchost.com 844 svchost.com 1300 svchost.com 1300 svchost.com 1168 svchost.com 1168 svchost.com 904 svchost.com 904 svchost.com 1940 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2052 svchost.com 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2052 svchost.com 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 2096 svchost.com 2096 svchost.com 2804 svchost.com 2804 svchost.com 2936 svchost.com 2936 svchost.com 2608 svchost.com 2608 svchost.com 1472 svchost.com 1472 svchost.com 2644 svchost.com 2644 svchost.com 1884 svchost.com 1884 svchost.com 700 svchost.com 700 svchost.com 1384 svchost.com 1384 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9D2E93~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9D2E93~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2E93~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 948 9D2E93~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2496 1940 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 30 PID 1940 wrote to memory of 2496 1940 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 30 PID 1940 wrote to memory of 2496 1940 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 30 PID 1940 wrote to memory of 2496 1940 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 30 PID 2496 wrote to memory of 820 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 31 PID 2496 wrote to memory of 820 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 31 PID 2496 wrote to memory of 820 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 31 PID 2496 wrote to memory of 820 2496 9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe 31 PID 820 wrote to memory of 1828 820 svchost.com 32 PID 820 wrote to memory of 1828 820 svchost.com 32 PID 820 wrote to memory of 1828 820 svchost.com 32 PID 820 wrote to memory of 1828 820 svchost.com 32 PID 1828 wrote to memory of 2676 1828 9D2E93~1.EXE 33 PID 1828 wrote to memory of 2676 1828 9D2E93~1.EXE 33 PID 1828 wrote to memory of 2676 1828 9D2E93~1.EXE 33 PID 1828 wrote to memory of 2676 1828 9D2E93~1.EXE 33 PID 2676 wrote to memory of 2788 2676 svchost.com 34 PID 2676 wrote to memory of 2788 2676 svchost.com 34 PID 2676 wrote to memory of 2788 2676 svchost.com 34 PID 2676 wrote to memory of 2788 2676 svchost.com 34 PID 2788 wrote to memory of 2944 2788 9D2E93~1.EXE 35 PID 2788 wrote to memory of 2944 2788 9D2E93~1.EXE 35 PID 2788 wrote to memory of 2944 2788 9D2E93~1.EXE 35 PID 2788 wrote to memory of 2944 2788 9D2E93~1.EXE 35 PID 2944 wrote to memory of 2824 2944 svchost.com 68 PID 2944 wrote to memory of 2824 2944 svchost.com 68 PID 2944 wrote to memory of 2824 2944 svchost.com 68 PID 2944 wrote to memory of 2824 2944 svchost.com 68 PID 2824 wrote to memory of 2620 2824 9D2E93~1.EXE 37 PID 2824 wrote to memory of 2620 2824 9D2E93~1.EXE 37 PID 2824 wrote to memory of 2620 2824 9D2E93~1.EXE 37 PID 2824 wrote to memory of 2620 2824 9D2E93~1.EXE 37 PID 2620 wrote to memory of 2752 2620 svchost.com 38 PID 2620 wrote to memory of 2752 2620 svchost.com 38 PID 2620 wrote to memory of 2752 2620 svchost.com 38 PID 2620 wrote to memory of 2752 2620 svchost.com 38 PID 2752 wrote to memory of 3012 2752 9D2E93~1.EXE 39 PID 2752 wrote to memory of 3012 2752 9D2E93~1.EXE 39 PID 2752 wrote to memory of 3012 2752 9D2E93~1.EXE 39 PID 2752 wrote to memory of 3012 2752 9D2E93~1.EXE 39 PID 3012 wrote to memory of 1180 3012 svchost.com 40 PID 3012 wrote to memory of 1180 3012 svchost.com 40 PID 3012 wrote to memory of 1180 3012 svchost.com 40 PID 3012 wrote to memory of 1180 3012 svchost.com 40 PID 1180 wrote to memory of 1800 1180 9D2E93~1.EXE 41 PID 1180 wrote to memory of 1800 1180 9D2E93~1.EXE 41 PID 1180 wrote to memory of 1800 1180 9D2E93~1.EXE 41 PID 1180 wrote to memory of 1800 1180 9D2E93~1.EXE 41 PID 1800 wrote to memory of 1656 1800 svchost.com 42 PID 1800 wrote to memory of 1656 1800 svchost.com 42 PID 1800 wrote to memory of 1656 1800 svchost.com 42 PID 1800 wrote to memory of 1656 1800 svchost.com 42 PID 1656 wrote to memory of 840 1656 9D2E93~1.EXE 126 PID 1656 wrote to memory of 840 1656 9D2E93~1.EXE 126 PID 1656 wrote to memory of 840 1656 9D2E93~1.EXE 126 PID 1656 wrote to memory of 840 1656 9D2E93~1.EXE 126 PID 840 wrote to memory of 2016 840 svchost.com 44 PID 840 wrote to memory of 2016 840 svchost.com 44 PID 840 wrote to memory of 2016 840 svchost.com 44 PID 840 wrote to memory of 2016 840 svchost.com 44 PID 2016 wrote to memory of 2684 2016 9D2E93~1.EXE 45 PID 2016 wrote to memory of 2684 2016 9D2E93~1.EXE 45 PID 2016 wrote to memory of 2684 2016 9D2E93~1.EXE 45 PID 2016 wrote to memory of 2684 2016 9D2E93~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe"C:\Users\Admin\AppData\Local\Temp\9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\9d2e93e3bca581bdb45c0ced62c02d26d3c8d4590ffac9a1d38c295780293451N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE18⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE20⤵
- Executes dropped EXE
PID:880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE22⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE24⤵
- Executes dropped EXE
PID:660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE26⤵
- Executes dropped EXE
PID:3064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE28⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE32⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE34⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE36⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE38⤵
- Executes dropped EXE
PID:2740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE40⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE42⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE46⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE52⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"53⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE54⤵
- Executes dropped EXE
PID:1908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"55⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE56⤵
- Executes dropped EXE
PID:2240 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"57⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE58⤵
- Executes dropped EXE
PID:1124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"59⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE60⤵
- Executes dropped EXE
PID:836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"61⤵
- Executes dropped EXE
PID:584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE62⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"63⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE64⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"65⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE66⤵PID:1632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"67⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE68⤵PID:2340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"69⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE70⤵
- Drops file in Windows directory
PID:1300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"71⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE72⤵PID:1944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"73⤵
- Drops file in Windows directory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE74⤵PID:2456
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"75⤵
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE76⤵PID:2504
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"77⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE78⤵PID:2768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"79⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE80⤵PID:3016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"81⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE82⤵
- Drops file in Windows directory
PID:2592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"83⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE84⤵PID:2840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"85⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE86⤵
- Drops file in Windows directory
PID:2612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"87⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE88⤵PID:3024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"89⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE90⤵PID:2132
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"91⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE92⤵
- System Location Discovery: System Language Discovery
PID:628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"93⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE94⤵PID:1792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"95⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE96⤵PID:700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"97⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE98⤵PID:840
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"99⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE100⤵PID:2472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"101⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE102⤵PID:2432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"103⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE104⤵PID:2020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"105⤵
- Drops file in Windows directory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE106⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"107⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE108⤵
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"109⤵
- Drops file in Windows directory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE110⤵PID:1540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"111⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE112⤵
- Drops file in Windows directory
PID:3056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"113⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE114⤵PID:2172
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"115⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE116⤵PID:1924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"117⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE118⤵PID:2416
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"119⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE120⤵PID:2308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D2E93~1.EXE"121⤵PID:2092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-