Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 18:22
Static task
static1
Behavioral task
behavioral1
Sample
219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71N.exe
Resource
win10v2004-20241007-en
General
-
Target
219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71N.exe
-
Size
1.4MB
-
MD5
bb7fea04b861ce18ff0db0dbb9715cb0
-
SHA1
62f65ccfe46b6a0f9b057ebcc343fecd64278377
-
SHA256
219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71
-
SHA512
cc3188703482ff9f0ba987e4c5950a731777d48dd78248bfdc740be90ae7be1a3db132233aede1452d03875372e1986e43a613a8bc572d453b7b8bc09563866c
-
SSDEEP
24576:O+SFQyRru2P6TW+/OMiFhTCRQwG6F5/xsSSBl76xPbdHURIcNTKarBI:oZubTWLb33s/xkl76FZUKaKarB
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EuDulh2jqC\ImagePath = "\\??\\C:\\Windows\\EuDulh2jqC8.sys" 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0005000000000735-44.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
Loads dropped DLL 3 IoCs
pid Process 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x0005000000000735-44.dat upx behavioral2/memory/4212-48-0x0000000073E50000-0x0000000073ED9000-memory.dmp upx behavioral2/memory/4212-68-0x0000000073E50000-0x0000000073ED9000-memory.dmp upx -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\qQRacyk\rirSLPFY.dll 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe File created C:\Windows\9.txt 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe File created C:\Windows\qQRacyk\hwUMJJU.tmp 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe File opened for modification C:\Windows\9.txt 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe File created C:\Windows\EuDulh2jqC8.sys 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe File created C:\Windows\qQRacyk\BcNXlRs.dll 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe File created C:\Windows\qQRacyk\rirSLPFY.dll 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe File created C:\Windows\urpErKl.dll 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe File created C:\Windows\qQRacyk\clOToS.dll 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe File created C:\Windows\qQRacyk\kLBDILewh.dll 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe File created C:\Windows\HqjRxg.dll 219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49} 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe Key deleted \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "https://www.hao123.com/?tn=92867579_hao_pg" 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.hao123.com/?tn=92867579_hao_pg" 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe Token: SeLoadDriverPrivilege 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe Token: 33 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe Token: SeIncBasePriorityPrivilege 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 4212 1672 219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 83 PID 1672 wrote to memory of 4212 1672 219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 83 PID 1672 wrote to memory of 4212 1672 219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 83 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56 PID 4212 wrote to memory of 3632 4212 219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71N.exe"C:\Users\Admin\AppData\Local\Temp\219022cfdfe40f8d24a17162fb5381a95acb4feac329273642dc633ccd6d6f71N.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\lNaxpe\219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe"C:\Users\Admin\AppData\Local\lNaxpe\219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe"3⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\lNaxpe\219022cfdfe40f8d24a1716fb5381a95acb4feac329273642dc633ccd6d6f71N.exe
Filesize1.4MB
MD5746bca11f8d16e347795dae743182d55
SHA19765b8b7d84f5bfa140c7965a7ce68a39aa32bb6
SHA256e61b59ff1124f7eba8a2c2aa1e51958cfb10217546ea0ce369e9314c8ee679bf
SHA51287c4eebaefb35a0d841a8b315fe540e866e3743e917c80ca7658704409c7d9e5a6f97be2d7c7367c01abd2d4bcef41d05d1ad66d100507f2e81101eec25c3c92
-
Filesize
869KB
MD55e53829069a7100453e5a1721ce1ae2e
SHA188128724be367c9b862b506abfd81e831da2bcaf
SHA256b49f7cf1ff4d96fedbdc85607c6a60154a210f4396ea3de2eb9ca71f960e9801
SHA51209990a58058d042eb79c4bff3b98f67d0d671e2f7787166706a2b62f8f436955d8c66c9a176448be45fdd62636140e3783ae4c8f8e0026669f4e35777cd8b2c3
-
Filesize
483KB
MD588c4820aa1ecfa3017963db6a60952a0
SHA195aeaa84e38c62059a703c6a8ce8712df9c990f9
SHA256bb3c682d5bbe59a63dd8fad19466f8c9f770df15acdbed580012be7cea62acbd
SHA512bde8c85f4232f24f415289e1aab61ce090cbd06442d774908a86ede135e74834e4c964c1a584df7a8d37fb56559126de24ff42c8497df7602534cb5d6100f5ee