Analysis
-
max time kernel
30s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05-11-2024 01:20
Behavioral task
behavioral1
Sample
de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe
-
Size
2.8MB
-
MD5
050fe10dde4508157dc203d67ab15a30
-
SHA1
15cea2dd37a69defda9622d996e31447e42fa712
-
SHA256
de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8
-
SHA512
4c8d244f37affbf9f2b4c0a87c627f432c4fa42d52698a47a2c5c46f7a0436dfadb2262be21e18ca97a57c4fbf8d7df8079ac1065adedb65fd1bea49b6e889ab
-
SSDEEP
49152:Pu7NudDVefXrT270uwtjLaneSRTcTdrbjvA53:Pu7NeD0fWwuw1LanAzvAx
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016cf0-2.dat family_neshta behavioral1/files/0x0007000000016d0c-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x0005000000010351-18.dat family_neshta behavioral1/files/0x0002000000010484-17.dat family_neshta behavioral1/memory/2488-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2808-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2876-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2752-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3040-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/576-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2612-81-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2256-80-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2904-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2260-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-98.dat family_neshta behavioral1/files/0x000100000000f77b-103.dat family_neshta behavioral1/files/0x000100000000f7cf-105.dat family_neshta behavioral1/files/0x000100000000f7dd-102.dat family_neshta behavioral1/files/0x000100000000f832-128.dat family_neshta behavioral1/files/0x000100000000f708-127.dat family_neshta behavioral1/files/0x000100000000f7eb-125.dat family_neshta behavioral1/memory/568-120-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-119-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f833-130.dat family_neshta behavioral1/files/0x000100000000f877-133.dat family_neshta behavioral1/files/0x00010000000114c5-135.dat family_neshta behavioral1/memory/2164-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/516-151-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2084-159-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2208-158-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3024-178-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/848-177-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/948-186-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1160-185-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2228-200-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2108-199-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-219-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1092-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2328-243-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2148-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-252-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/880-253-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1596-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2884-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2800-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1724-275-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2120-286-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2708-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3040-294-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2660-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2672-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2576-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1928-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3000-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2920-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2932-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2924-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3044-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1884-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 2488 svchost.com 2808 DE36A0~1.EXE 2752 svchost.com 2876 DE36A0~1.EXE 3040 svchost.com 576 DE36A0~1.EXE 2612 svchost.com 2256 DE36A0~1.EXE 2260 svchost.com 2904 DE36A0~1.EXE 568 svchost.com 2936 DE36A0~1.EXE 2164 svchost.com 516 DE36A0~1.EXE 2084 svchost.com 2208 DE36A0~1.EXE 3024 svchost.com 848 DE36A0~1.EXE 948 svchost.com 1160 DE36A0~1.EXE 2228 svchost.com 2108 DE36A0~1.EXE 2432 svchost.com 1092 DE36A0~1.EXE 2328 svchost.com 2148 DE36A0~1.EXE 880 svchost.com 1636 DE36A0~1.EXE 1596 svchost.com 2884 DE36A0~1.EXE 1724 svchost.com 2800 DE36A0~1.EXE 2736 svchost.com 2120 DE36A0~1.EXE 2708 svchost.com 3040 DE36A0~1.EXE 2660 svchost.com 2672 DE36A0~1.EXE 1928 svchost.com 2576 DE36A0~1.EXE 3000 svchost.com 2920 DE36A0~1.EXE 2828 svchost.com 2932 DE36A0~1.EXE 2924 svchost.com 3044 DE36A0~1.EXE 2632 svchost.com 1884 DE36A0~1.EXE 1924 svchost.com 2508 DE36A0~1.EXE 2304 svchost.com 2164 DE36A0~1.EXE 2060 svchost.com 2204 DE36A0~1.EXE 3020 svchost.com 1140 DE36A0~1.EXE 1196 svchost.com 3024 DE36A0~1.EXE 812 svchost.com 904 DE36A0~1.EXE 948 svchost.com 1484 DE36A0~1.EXE 1548 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 1728 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 1728 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 2488 svchost.com 2488 svchost.com 2752 svchost.com 2752 svchost.com 3040 svchost.com 3040 svchost.com 2612 svchost.com 2612 svchost.com 2260 svchost.com 2260 svchost.com 568 svchost.com 568 svchost.com 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 1728 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 2164 svchost.com 2164 svchost.com 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 2084 svchost.com 2084 svchost.com 3024 svchost.com 3024 svchost.com 948 svchost.com 948 svchost.com 2228 svchost.com 2228 svchost.com 2432 svchost.com 2432 svchost.com 2328 svchost.com 2328 svchost.com 880 svchost.com 880 svchost.com 1596 svchost.com 1596 svchost.com 1724 svchost.com 1724 svchost.com 2736 svchost.com 2736 svchost.com 2708 svchost.com 2708 svchost.com 2660 svchost.com 2660 svchost.com 1928 svchost.com 1928 svchost.com 3000 svchost.com 3000 svchost.com 2828 svchost.com 2828 svchost.com 2924 svchost.com 2924 svchost.com 2632 svchost.com 2632 svchost.com 1924 svchost.com 1924 svchost.com 2304 svchost.com 2304 svchost.com 2060 svchost.com 2060 svchost.com 3020 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\svchost.com de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys DE36A0~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\svchost.com DE36A0~1.EXE File opened for modification C:\Windows\directx.sys DE36A0~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36A0~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2524 1728 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 31 PID 1728 wrote to memory of 2524 1728 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 31 PID 1728 wrote to memory of 2524 1728 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 31 PID 1728 wrote to memory of 2524 1728 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 31 PID 2524 wrote to memory of 2488 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 32 PID 2524 wrote to memory of 2488 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 32 PID 2524 wrote to memory of 2488 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 32 PID 2524 wrote to memory of 2488 2524 de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe 32 PID 2488 wrote to memory of 2808 2488 svchost.com 33 PID 2488 wrote to memory of 2808 2488 svchost.com 33 PID 2488 wrote to memory of 2808 2488 svchost.com 33 PID 2488 wrote to memory of 2808 2488 svchost.com 33 PID 2808 wrote to memory of 2752 2808 DE36A0~1.EXE 34 PID 2808 wrote to memory of 2752 2808 DE36A0~1.EXE 34 PID 2808 wrote to memory of 2752 2808 DE36A0~1.EXE 34 PID 2808 wrote to memory of 2752 2808 DE36A0~1.EXE 34 PID 2752 wrote to memory of 2876 2752 svchost.com 35 PID 2752 wrote to memory of 2876 2752 svchost.com 35 PID 2752 wrote to memory of 2876 2752 svchost.com 35 PID 2752 wrote to memory of 2876 2752 svchost.com 35 PID 2876 wrote to memory of 3040 2876 DE36A0~1.EXE 67 PID 2876 wrote to memory of 3040 2876 DE36A0~1.EXE 67 PID 2876 wrote to memory of 3040 2876 DE36A0~1.EXE 67 PID 2876 wrote to memory of 3040 2876 DE36A0~1.EXE 67 PID 3040 wrote to memory of 576 3040 svchost.com 37 PID 3040 wrote to memory of 576 3040 svchost.com 37 PID 3040 wrote to memory of 576 3040 svchost.com 37 PID 3040 wrote to memory of 576 3040 svchost.com 37 PID 576 wrote to memory of 2612 576 DE36A0~1.EXE 38 PID 576 wrote to memory of 2612 576 DE36A0~1.EXE 38 PID 576 wrote to memory of 2612 576 DE36A0~1.EXE 38 PID 576 wrote to memory of 2612 576 DE36A0~1.EXE 38 PID 2612 wrote to memory of 2256 2612 svchost.com 39 PID 2612 wrote to memory of 2256 2612 svchost.com 39 PID 2612 wrote to memory of 2256 2612 svchost.com 39 PID 2612 wrote to memory of 2256 2612 svchost.com 39 PID 2256 wrote to memory of 2260 2256 DE36A0~1.EXE 40 PID 2256 wrote to memory of 2260 2256 DE36A0~1.EXE 40 PID 2256 wrote to memory of 2260 2256 DE36A0~1.EXE 40 PID 2256 wrote to memory of 2260 2256 DE36A0~1.EXE 40 PID 2260 wrote to memory of 2904 2260 svchost.com 41 PID 2260 wrote to memory of 2904 2260 svchost.com 41 PID 2260 wrote to memory of 2904 2260 svchost.com 41 PID 2260 wrote to memory of 2904 2260 svchost.com 41 PID 2904 wrote to memory of 568 2904 DE36A0~1.EXE 122 PID 2904 wrote to memory of 568 2904 DE36A0~1.EXE 122 PID 2904 wrote to memory of 568 2904 DE36A0~1.EXE 122 PID 2904 wrote to memory of 568 2904 DE36A0~1.EXE 122 PID 568 wrote to memory of 2936 568 svchost.com 43 PID 568 wrote to memory of 2936 568 svchost.com 43 PID 568 wrote to memory of 2936 568 svchost.com 43 PID 568 wrote to memory of 2936 568 svchost.com 43 PID 2936 wrote to memory of 2164 2936 DE36A0~1.EXE 83 PID 2936 wrote to memory of 2164 2936 DE36A0~1.EXE 83 PID 2936 wrote to memory of 2164 2936 DE36A0~1.EXE 83 PID 2936 wrote to memory of 2164 2936 DE36A0~1.EXE 83 PID 2164 wrote to memory of 516 2164 svchost.com 45 PID 2164 wrote to memory of 516 2164 svchost.com 45 PID 2164 wrote to memory of 516 2164 svchost.com 45 PID 2164 wrote to memory of 516 2164 svchost.com 45 PID 516 wrote to memory of 2084 516 DE36A0~1.EXE 46 PID 516 wrote to memory of 2084 516 DE36A0~1.EXE 46 PID 516 wrote to memory of 2084 516 DE36A0~1.EXE 46 PID 516 wrote to memory of 2084 516 DE36A0~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe"C:\Users\Admin\AppData\Local\Temp\de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\de36a0601bab78575ff29330205581b2bc2b5ce5bd441c1e59eb7926be76b8d8N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2208 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE22⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE30⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE32⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE34⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE36⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE38⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE40⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE46⤵
- Executes dropped EXE
PID:2932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE48⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE56⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE58⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1140 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"59⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE60⤵
- Executes dropped EXE
PID:3024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"61⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE62⤵
- Executes dropped EXE
PID:904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE64⤵
- Executes dropped EXE
PID:1484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE66⤵PID:1712
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"67⤵
- System Location Discovery: System Language Discovery
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE68⤵PID:836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"69⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE70⤵PID:572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"71⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE72⤵
- Drops file in Windows directory
PID:832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"73⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE74⤵PID:1572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"75⤵
- Drops file in Windows directory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE76⤵PID:2172
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"77⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE78⤵PID:2704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"79⤵
- Drops file in Windows directory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE80⤵
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"81⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE82⤵PID:2796
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"83⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE84⤵PID:2648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"85⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE86⤵PID:1536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"87⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE88⤵
- Drops file in Windows directory
PID:1064 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"89⤵
- Drops file in Windows directory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE90⤵PID:2272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"91⤵
- Drops file in Windows directory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE92⤵PID:2932
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"93⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE94⤵PID:2924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"95⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE96⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"97⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE98⤵PID:2044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"99⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE100⤵PID:2500
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE102⤵PID:3016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"103⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE104⤵PID:996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"105⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE106⤵
- System Location Discovery: System Language Discovery
PID:2040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"107⤵
- Drops file in Windows directory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE108⤵PID:872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"109⤵
- Drops file in Windows directory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE110⤵
- Drops file in Windows directory
PID:3060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"111⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE112⤵PID:268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"113⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE114⤵PID:1500
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"115⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE116⤵PID:2412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"117⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE118⤵PID:1216
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"119⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE120⤵
- System Location Discovery: System Language Discovery
PID:856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DE36A0~1.EXE"121⤵PID:1068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-