Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
29-11-2024 23:40
Behavioral task
behavioral1
Sample
126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe
Resource
win7-20241023-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe
-
Size
1.0MB
-
MD5
37c56f70b2b41a67ffe99228240ca840
-
SHA1
3bd51b79299fd7260f68b189cfc13fb77759b138
-
SHA256
126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fc
-
SHA512
124e4afc88bcfbab0c338a464bf107e6bdbb830cdb5009887bb1a5e625861f23ca9745784a30c35b6a68b54158aa04e3102ac557df860f4d40c2638528646d35
-
SSDEEP
24576:ja6rfyCY3YSXzaCNaCNaCNaCNaCNaCNaCNaCNa61:JG3Y653333333P1
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000015d41-16.dat family_neshta behavioral1/files/0x0007000000015d89-23.dat family_neshta behavioral1/files/0x0007000000015ec4-33.dat family_neshta behavioral1/files/0x0013000000010681-42.dat family_neshta behavioral1/files/0x0001000000010319-44.dat family_neshta behavioral1/files/0x0001000000010317-43.dat family_neshta behavioral1/memory/2640-53-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2892-55-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2968-68-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2848-69-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2684-83-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2560-82-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3032-104-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1980-103-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/356-110-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2768-109-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2440-124-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f778-137.dat family_neshta behavioral1/memory/2044-125-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2956-153-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f876-148.dat family_neshta behavioral1/memory/2248-174-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2088-175-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/972-192-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2660-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2524-200-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1912-201-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1904-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1992-216-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/344-244-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1032-243-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1976-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1964-256-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2476-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2412-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2352-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1572-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2944-298-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2960-306-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2640-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/696-314-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2792-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2692-322-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2584-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3040-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2504-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1696-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1648-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/816-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1248-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1052-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1164-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/328-362-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2364-370-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3048-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1704-379-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3044-378-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1860-387-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/700-386-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2612 svchost.exe 1752 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 2408 svchost.exe 2860 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 2892 svchost.com 2640 126B26~1.EXE 2968 svchost.com 2848 126B26~1.EXE 2684 svchost.com 2560 126B26~1.EXE 1980 svchost.com 3032 126B26~1.EXE 356 svchost.com 2768 126B26~1.EXE 2440 svchost.com 2044 126B26~1.EXE 2956 svchost.com 3016 126B26~1.EXE 2248 svchost.com 2088 126B26~1.EXE 2660 svchost.com 972 126B26~1.EXE 2524 svchost.com 1912 126B26~1.EXE 1904 svchost.com 1992 126B26~1.EXE 1032 svchost.com 344 126B26~1.EXE 1976 svchost.com 1964 126B26~1.EXE 2412 svchost.com 2476 126B26~1.EXE 2352 svchost.com 1572 126B26~1.EXE 2784 svchost.com 2832 126B26~1.EXE 2688 svchost.com 2944 126B26~1.EXE 2640 svchost.com 2960 126B26~1.EXE 2792 svchost.com 696 126B26~1.EXE 2692 svchost.com 2584 126B26~1.EXE 2504 svchost.com 3040 126B26~1.EXE 1696 svchost.com 2740 126B26~1.EXE 816 svchost.com 1648 126B26~1.EXE 1248 svchost.com 1052 126B26~1.EXE 328 svchost.com 1164 126B26~1.EXE 3048 svchost.com 2364 126B26~1.EXE 3044 svchost.com 1704 126B26~1.EXE 1860 svchost.com 700 126B26~1.EXE 2068 svchost.com 680 126B26~1.EXE 1788 svchost.com 304 126B26~1.EXE -
Loads dropped DLL 64 IoCs
pid Process 2612 svchost.exe 2612 svchost.exe 1752 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 1752 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 2860 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 2892 svchost.com 2892 svchost.com 2968 svchost.com 2968 svchost.com 2684 svchost.com 2684 svchost.com 1980 svchost.com 1980 svchost.com 356 svchost.com 356 svchost.com 2440 svchost.com 2440 svchost.com 2956 svchost.com 2956 svchost.com 1752 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 2860 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 1752 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 2248 svchost.com 2248 svchost.com 2660 svchost.com 2660 svchost.com 2524 svchost.com 2524 svchost.com 1904 svchost.com 1904 svchost.com 1032 svchost.com 1032 svchost.com 1976 svchost.com 1976 svchost.com 2412 svchost.com 2412 svchost.com 2352 svchost.com 2352 svchost.com 2784 svchost.com 2784 svchost.com 2688 svchost.com 2688 svchost.com 2640 svchost.com 2640 svchost.com 2792 svchost.com 2792 svchost.com 2692 svchost.com 2692 svchost.com 2504 svchost.com 2504 svchost.com 1696 svchost.com 1696 svchost.com 816 svchost.com 816 svchost.com 1248 svchost.com 1248 svchost.com 328 svchost.com 328 svchost.com 3048 svchost.com 3048 svchost.com 3044 svchost.com 3044 svchost.com 1860 svchost.com 1860 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File created C:\Windows\svchost.exe 126B26~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 126B26~1.EXE File opened for modification C:\Windows\svchost.com 126B26~1.EXE File opened for modification C:\Windows\directx.sys 126B26~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 126B26~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 2612 2592 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 30 PID 2592 wrote to memory of 2612 2592 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 30 PID 2592 wrote to memory of 2612 2592 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 30 PID 2592 wrote to memory of 2612 2592 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 30 PID 2612 wrote to memory of 1752 2612 svchost.exe 31 PID 2612 wrote to memory of 1752 2612 svchost.exe 31 PID 2612 wrote to memory of 1752 2612 svchost.exe 31 PID 2612 wrote to memory of 1752 2612 svchost.exe 31 PID 1752 wrote to memory of 2860 1752 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 33 PID 1752 wrote to memory of 2860 1752 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 33 PID 1752 wrote to memory of 2860 1752 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 33 PID 1752 wrote to memory of 2860 1752 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 33 PID 2860 wrote to memory of 2892 2860 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 34 PID 2860 wrote to memory of 2892 2860 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 34 PID 2860 wrote to memory of 2892 2860 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 34 PID 2860 wrote to memory of 2892 2860 126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe 34 PID 2892 wrote to memory of 2640 2892 svchost.com 35 PID 2892 wrote to memory of 2640 2892 svchost.com 35 PID 2892 wrote to memory of 2640 2892 svchost.com 35 PID 2892 wrote to memory of 2640 2892 svchost.com 35 PID 2640 wrote to memory of 2968 2640 126B26~1.EXE 36 PID 2640 wrote to memory of 2968 2640 126B26~1.EXE 36 PID 2640 wrote to memory of 2968 2640 126B26~1.EXE 36 PID 2640 wrote to memory of 2968 2640 126B26~1.EXE 36 PID 2968 wrote to memory of 2848 2968 svchost.com 37 PID 2968 wrote to memory of 2848 2968 svchost.com 37 PID 2968 wrote to memory of 2848 2968 svchost.com 37 PID 2968 wrote to memory of 2848 2968 svchost.com 37 PID 2848 wrote to memory of 2684 2848 126B26~1.EXE 38 PID 2848 wrote to memory of 2684 2848 126B26~1.EXE 38 PID 2848 wrote to memory of 2684 2848 126B26~1.EXE 38 PID 2848 wrote to memory of 2684 2848 126B26~1.EXE 38 PID 2684 wrote to memory of 2560 2684 svchost.com 39 PID 2684 wrote to memory of 2560 2684 svchost.com 39 PID 2684 wrote to memory of 2560 2684 svchost.com 39 PID 2684 wrote to memory of 2560 2684 svchost.com 39 PID 2560 wrote to memory of 1980 2560 126B26~1.EXE 40 PID 2560 wrote to memory of 1980 2560 126B26~1.EXE 40 PID 2560 wrote to memory of 1980 2560 126B26~1.EXE 40 PID 2560 wrote to memory of 1980 2560 126B26~1.EXE 40 PID 1980 wrote to memory of 3032 1980 svchost.com 41 PID 1980 wrote to memory of 3032 1980 svchost.com 41 PID 1980 wrote to memory of 3032 1980 svchost.com 41 PID 1980 wrote to memory of 3032 1980 svchost.com 41 PID 3032 wrote to memory of 356 3032 126B26~1.EXE 42 PID 3032 wrote to memory of 356 3032 126B26~1.EXE 42 PID 3032 wrote to memory of 356 3032 126B26~1.EXE 42 PID 3032 wrote to memory of 356 3032 126B26~1.EXE 42 PID 356 wrote to memory of 2768 356 svchost.com 43 PID 356 wrote to memory of 2768 356 svchost.com 43 PID 356 wrote to memory of 2768 356 svchost.com 43 PID 356 wrote to memory of 2768 356 svchost.com 43 PID 2768 wrote to memory of 2440 2768 126B26~1.EXE 44 PID 2768 wrote to memory of 2440 2768 126B26~1.EXE 44 PID 2768 wrote to memory of 2440 2768 126B26~1.EXE 44 PID 2768 wrote to memory of 2440 2768 126B26~1.EXE 44 PID 2440 wrote to memory of 2044 2440 svchost.com 45 PID 2440 wrote to memory of 2044 2440 svchost.com 45 PID 2440 wrote to memory of 2044 2440 svchost.com 45 PID 2440 wrote to memory of 2044 2440 svchost.com 45 PID 2044 wrote to memory of 2956 2044 126B26~1.EXE 46 PID 2044 wrote to memory of 2956 2044 126B26~1.EXE 46 PID 2044 wrote to memory of 2956 2044 126B26~1.EXE 46 PID 2044 wrote to memory of 2956 2044 126B26~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe"C:\Users\Admin\AppData\Local\Temp\126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe"C:\Users\Admin\AppData\Local\Temp\126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\126b26b3e1035b2185f44b02f2cb43552db3eb1f6dfd80721fa1595ae0b855fcN.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE18⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE20⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE22⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE24⤵
- Executes dropped EXE
PID:1912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE26⤵
- Executes dropped EXE
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:344 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE30⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE32⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE34⤵
- Executes dropped EXE
PID:1572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE36⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE38⤵
- Executes dropped EXE
PID:2944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE44⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE50⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE52⤵
- Executes dropped EXE
PID:1052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE56⤵
- Executes dropped EXE
PID:2364 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE58⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE60⤵
- Executes dropped EXE
PID:700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"61⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE62⤵
- Executes dropped EXE
PID:680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"63⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE64⤵
- Executes dropped EXE
PID:304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"65⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE66⤵
- System Location Discovery: System Language Discovery
PID:2252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"67⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"69⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE70⤵PID:2868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"71⤵
- System Location Discovery: System Language Discovery
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE72⤵
- Drops file in Windows directory
PID:2780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"73⤵
- Drops file in Windows directory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE74⤵PID:1316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"75⤵
- Drops file in Windows directory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE76⤵PID:1960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"77⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE78⤵PID:2464
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"79⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE80⤵PID:2380
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"81⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE82⤵
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"83⤵
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE84⤵PID:536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"85⤵
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE86⤵PID:2900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"87⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE88⤵PID:2816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"89⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE90⤵PID:2800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"91⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE92⤵PID:2756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"93⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE94⤵PID:2356
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"95⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE96⤵PID:2124
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"97⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE98⤵PID:1740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"99⤵
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE100⤵PID:1824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"101⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE102⤵PID:1764
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"103⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE104⤵PID:2496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"105⤵
- Drops file in Windows directory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE106⤵
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"107⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE108⤵PID:1860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"109⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE110⤵PID:2076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"111⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE112⤵
- Drops file in Windows directory
PID:2576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE114⤵PID:2452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"115⤵
- Drops file in Windows directory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE116⤵
- System Location Discovery: System Language Discovery
PID:1328 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"117⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE118⤵
- Drops file in Windows directory
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"119⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE120⤵
- System Location Discovery: System Language Discovery
PID:2780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\126B26~1.EXE"121⤵PID:812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-