Analysis
-
max time kernel
26s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 03:00
Behavioral task
behavioral1
Sample
b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe
-
Size
209KB
-
MD5
335927026a466be229fc54696779c150
-
SHA1
eae6941995865cb506f0c93f87ae8acbc9204812
-
SHA256
b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8c
-
SHA512
250a5ab8217e8246312a1598cc22974022b3acd9b8e1c40212b9f0b894f1bd9ecbda3b95df3295e5f19549f657278314765269da6c414b107b78b6d13023b525
-
SSDEEP
3072:sr85CvzzNZYjXkZYsNUIcFMtqWJkZYsNUIcFMtqWHr85C:k94SXUNFzWoXUNFzWL9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016d0c-2.dat family_neshta behavioral1/files/0x005b00000001032b-16.dat family_neshta behavioral1/files/0x0001000000010318-19.dat family_neshta behavioral1/files/0x0001000000010316-18.dat family_neshta behavioral1/files/0x001400000000f842-17.dat family_neshta behavioral1/files/0x0008000000016d1f-15.dat family_neshta behavioral1/memory/2804-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1108-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/340-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2408-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/608-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/896-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2676-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2084-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2788-112-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2960-111-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7cf-101.dat family_neshta behavioral1/memory/2860-135-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2488-134-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010f34-150.dat family_neshta behavioral1/files/0x0001000000011800-147.dat family_neshta behavioral1/files/0x0001000000011a1c-157.dat family_neshta behavioral1/files/0x0001000000011b5b-160.dat family_neshta behavioral1/memory/1520-164-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3028-163-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1532-184-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1176-183-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-192-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1564-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1812-206-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1280-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1756-225-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2108-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2576-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2352-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2824-258-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2324-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2844-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1548-274-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2720-283-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2652-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/604-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2440-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1524-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/528-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2660-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2292-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/652-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/564-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2040-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2140-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1444-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2856-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1884-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2200-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2964-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2792-356-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2232-357-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1824-364-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2860-365-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2464-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2852 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 2804 svchost.com 1108 B766E3~1.EXE 2832 svchost.com 340 B766E3~1.EXE 2408 svchost.com 608 B766E3~1.EXE 896 svchost.com 2676 B766E3~1.EXE 2224 svchost.com 2084 B766E3~1.EXE 2788 svchost.com 2960 B766E3~1.EXE 2860 svchost.com 2488 B766E3~1.EXE 1520 svchost.com 3028 B766E3~1.EXE 1532 svchost.com 1176 B766E3~1.EXE 1564 svchost.com 1708 B766E3~1.EXE 1812 svchost.com 1280 B766E3~1.EXE 1756 svchost.com 2108 B766E3~1.EXE 2576 svchost.com 2352 B766E3~1.EXE 2324 svchost.com 2824 B766E3~1.EXE 1548 svchost.com 2844 B766E3~1.EXE 2720 svchost.com 2652 B766E3~1.EXE 2440 svchost.com 604 B766E3~1.EXE 1524 svchost.com 528 B766E3~1.EXE 1308 svchost.com 2660 B766E3~1.EXE 652 svchost.com 2292 B766E3~1.EXE 564 svchost.com 2040 B766E3~1.EXE 2140 svchost.com 1444 B766E3~1.EXE 2856 svchost.com 1884 B766E3~1.EXE 2964 svchost.com 2200 B766E3~1.EXE 2792 svchost.com 2232 B766E3~1.EXE 2860 svchost.com 1824 B766E3~1.EXE 2128 svchost.com 2464 B766E3~1.EXE 1940 svchost.com 408 B766E3~1.EXE 376 svchost.com 2972 B766E3~1.EXE 2204 svchost.com 2412 B766E3~1.EXE 1340 svchost.com 1928 B766E3~1.EXE 1320 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2764 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 2764 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 2804 svchost.com 2804 svchost.com 2832 svchost.com 2832 svchost.com 2408 svchost.com 2408 svchost.com 896 svchost.com 896 svchost.com 2224 svchost.com 2224 svchost.com 2788 svchost.com 2788 svchost.com 2852 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 2764 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 2860 svchost.com 2860 svchost.com 1520 svchost.com 1520 svchost.com 1532 svchost.com 1532 svchost.com 2764 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 1564 svchost.com 1564 svchost.com 1812 svchost.com 1812 svchost.com 1756 svchost.com 1756 svchost.com 2576 svchost.com 2576 svchost.com 2324 svchost.com 2324 svchost.com 1548 svchost.com 1548 svchost.com 2720 svchost.com 2720 svchost.com 2440 svchost.com 2440 svchost.com 1524 svchost.com 1524 svchost.com 1308 svchost.com 1308 svchost.com 652 svchost.com 652 svchost.com 564 svchost.com 564 svchost.com 2140 svchost.com 2140 svchost.com 2856 svchost.com 2856 svchost.com 2964 svchost.com 2964 svchost.com 2792 svchost.com 2792 svchost.com 2860 svchost.com 2860 svchost.com 2128 svchost.com 2128 svchost.com 1940 svchost.com 1940 svchost.com 376 svchost.com 376 svchost.com 2204 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\svchost.com B766E3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B766E3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys B766E3~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766E3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2852 2764 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 30 PID 2764 wrote to memory of 2852 2764 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 30 PID 2764 wrote to memory of 2852 2764 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 30 PID 2764 wrote to memory of 2852 2764 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 30 PID 2852 wrote to memory of 2804 2852 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 31 PID 2852 wrote to memory of 2804 2852 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 31 PID 2852 wrote to memory of 2804 2852 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 31 PID 2852 wrote to memory of 2804 2852 b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe 31 PID 2804 wrote to memory of 1108 2804 svchost.com 32 PID 2804 wrote to memory of 1108 2804 svchost.com 32 PID 2804 wrote to memory of 1108 2804 svchost.com 32 PID 2804 wrote to memory of 1108 2804 svchost.com 32 PID 1108 wrote to memory of 2832 1108 B766E3~1.EXE 33 PID 1108 wrote to memory of 2832 1108 B766E3~1.EXE 33 PID 1108 wrote to memory of 2832 1108 B766E3~1.EXE 33 PID 1108 wrote to memory of 2832 1108 B766E3~1.EXE 33 PID 2832 wrote to memory of 340 2832 svchost.com 34 PID 2832 wrote to memory of 340 2832 svchost.com 34 PID 2832 wrote to memory of 340 2832 svchost.com 34 PID 2832 wrote to memory of 340 2832 svchost.com 34 PID 340 wrote to memory of 2408 340 B766E3~1.EXE 35 PID 340 wrote to memory of 2408 340 B766E3~1.EXE 35 PID 340 wrote to memory of 2408 340 B766E3~1.EXE 35 PID 340 wrote to memory of 2408 340 B766E3~1.EXE 35 PID 2408 wrote to memory of 608 2408 svchost.com 36 PID 2408 wrote to memory of 608 2408 svchost.com 36 PID 2408 wrote to memory of 608 2408 svchost.com 36 PID 2408 wrote to memory of 608 2408 svchost.com 36 PID 608 wrote to memory of 896 608 B766E3~1.EXE 37 PID 608 wrote to memory of 896 608 B766E3~1.EXE 37 PID 608 wrote to memory of 896 608 B766E3~1.EXE 37 PID 608 wrote to memory of 896 608 B766E3~1.EXE 37 PID 896 wrote to memory of 2676 896 svchost.com 38 PID 896 wrote to memory of 2676 896 svchost.com 38 PID 896 wrote to memory of 2676 896 svchost.com 38 PID 896 wrote to memory of 2676 896 svchost.com 38 PID 2676 wrote to memory of 2224 2676 B766E3~1.EXE 39 PID 2676 wrote to memory of 2224 2676 B766E3~1.EXE 39 PID 2676 wrote to memory of 2224 2676 B766E3~1.EXE 39 PID 2676 wrote to memory of 2224 2676 B766E3~1.EXE 39 PID 2224 wrote to memory of 2084 2224 svchost.com 40 PID 2224 wrote to memory of 2084 2224 svchost.com 40 PID 2224 wrote to memory of 2084 2224 svchost.com 40 PID 2224 wrote to memory of 2084 2224 svchost.com 40 PID 2084 wrote to memory of 2788 2084 B766E3~1.EXE 126 PID 2084 wrote to memory of 2788 2084 B766E3~1.EXE 126 PID 2084 wrote to memory of 2788 2084 B766E3~1.EXE 126 PID 2084 wrote to memory of 2788 2084 B766E3~1.EXE 126 PID 2788 wrote to memory of 2960 2788 svchost.com 42 PID 2788 wrote to memory of 2960 2788 svchost.com 42 PID 2788 wrote to memory of 2960 2788 svchost.com 42 PID 2788 wrote to memory of 2960 2788 svchost.com 42 PID 2960 wrote to memory of 2860 2960 B766E3~1.EXE 133 PID 2960 wrote to memory of 2860 2960 B766E3~1.EXE 133 PID 2960 wrote to memory of 2860 2960 B766E3~1.EXE 133 PID 2960 wrote to memory of 2860 2960 B766E3~1.EXE 133 PID 2860 wrote to memory of 2488 2860 svchost.com 44 PID 2860 wrote to memory of 2488 2860 svchost.com 44 PID 2860 wrote to memory of 2488 2860 svchost.com 44 PID 2860 wrote to memory of 2488 2860 svchost.com 44 PID 2488 wrote to memory of 1520 2488 B766E3~1.EXE 45 PID 2488 wrote to memory of 1520 2488 B766E3~1.EXE 45 PID 2488 wrote to memory of 1520 2488 B766E3~1.EXE 45 PID 2488 wrote to memory of 1520 2488 B766E3~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe"C:\Users\Admin\AppData\Local\Temp\b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\b766e3331690af7804f1f875c7479f559d24fc3be0ecf5de6fbb758bf4730d8cN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE18⤵
- Executes dropped EXE
PID:3028 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1176 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE22⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE26⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE28⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE30⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE32⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE34⤵
- Executes dropped EXE
PID:2652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE36⤵
- Executes dropped EXE
PID:604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:528 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE40⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE42⤵
- Executes dropped EXE
PID:2292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE48⤵
- Executes dropped EXE
PID:1884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE50⤵
- Executes dropped EXE
PID:2200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE52⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE54⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE56⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE58⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"63⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE64⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"65⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE66⤵PID:2884
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"67⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE68⤵PID:824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"69⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE70⤵PID:1628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"71⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE72⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"73⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE74⤵
- Drops file in Windows directory
PID:1448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"75⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE76⤵PID:1228
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"77⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE78⤵
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"79⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE80⤵PID:2616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"81⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE82⤵
- Drops file in Windows directory
PID:2908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"83⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE84⤵PID:2944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"85⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE86⤵PID:2640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"87⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE88⤵PID:2172
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"89⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE90⤵PID:2000
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"91⤵
- Drops file in Windows directory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE92⤵
- Drops file in Windows directory
PID:880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"93⤵
- System Location Discovery: System Language Discovery
PID:580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE94⤵PID:1736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"95⤵
- System Location Discovery: System Language Discovery
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE96⤵
- Drops file in Windows directory
PID:2516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"97⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE98⤵PID:2788
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"99⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE100⤵PID:3060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"101⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE102⤵PID:2508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"103⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE104⤵PID:3032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"105⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE106⤵PID:1688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"107⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE108⤵PID:1424
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"109⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE110⤵PID:1744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"111⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE112⤵
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"113⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE114⤵PID:1564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE116⤵
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"117⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE118⤵PID:572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"119⤵
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE120⤵PID:1628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B766E3~1.EXE"121⤵PID:2024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-