Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-01-2025 23:28
Behavioral task
behavioral1
Sample
1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe
-
Size
482KB
-
MD5
eb0b24dc17d606db50357792ba08a3f0
-
SHA1
d4db8ccf2366462de37047e871fede7ac3973c69
-
SHA256
1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073ca
-
SHA512
035373f13628dda81d517b913c25ee13f6a02d5276c18c8d28ca337decfbce2dfcf522961758f05d1790d3f6c1bd46ae0768e79a4abd976e0ff0f5ffe873a903
-
SSDEEP
3072:sr85CCQ2z1yr5JShnr85Cxr85Cxr85Cxr85Cxr85Cxr85Cxr85Cxr85Cxr85Cxr9:k9CQvAr9N9N9N9N9N9N9N9N9N9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0007000000016a47-2.dat family_neshta behavioral1/files/0x0033000000010618-16.dat family_neshta behavioral1/files/0x0008000000016c3d-15.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x0007000000010348-17.dat family_neshta behavioral1/memory/1196-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2680-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2752-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2672-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2812-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2564-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2612-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2652-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/632-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2584-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2876-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/268-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-105.dat family_neshta behavioral1/files/0x000100000000f7e6-111.dat family_neshta behavioral1/files/0x000100000000f7ca-110.dat family_neshta behavioral1/files/0x000100000000f776-109.dat family_neshta behavioral1/memory/2012-127-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-126-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f82d-139.dat family_neshta behavioral1/files/0x000100000000f872-146.dat family_neshta behavioral1/memory/2236-151-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2220-150-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2448-164-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1476-165-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1764-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/980-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2912-190-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1584-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1292-206-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2800-207-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2396-215-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2100-214-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/300-228-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/996-229-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2344-248-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1180-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-266-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2324-265-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2760-283-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2256-282-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2376-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2156-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2900-305-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2580-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2536-314-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2164-313-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2652-322-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/536-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/820-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/268-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2780-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1992-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1360-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/952-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1612-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2392-362-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2212-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2340 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 1196 svchost.com 2680 1BD926~1.EXE 2752 svchost.com 2672 1BD926~1.EXE 2812 svchost.com 2564 1BD926~1.EXE 2652 svchost.com 2612 1BD926~1.EXE 2584 svchost.com 632 1BD926~1.EXE 2876 svchost.com 268 1BD926~1.EXE 2012 svchost.com 1492 1BD926~1.EXE 2236 svchost.com 2220 1BD926~1.EXE 1476 svchost.com 2448 1BD926~1.EXE 980 svchost.com 1764 1BD926~1.EXE 1584 svchost.com 2912 1BD926~1.EXE 2800 svchost.com 1292 1BD926~1.EXE 2396 svchost.com 2100 1BD926~1.EXE 996 svchost.com 300 1BD926~1.EXE 2344 svchost.com 1180 1BD926~1.EXE 2316 svchost.com 2324 1BD926~1.EXE 2256 svchost.com 2760 1BD926~1.EXE 2156 svchost.com 2376 1BD926~1.EXE 2900 svchost.com 2580 1BD926~1.EXE 2536 svchost.com 2164 1BD926~1.EXE 2652 svchost.com 536 1BD926~1.EXE 2828 svchost.com 820 1BD926~1.EXE 2780 svchost.com 268 1BD926~1.EXE 1360 svchost.com 1992 1BD926~1.EXE 952 svchost.com 1612 1BD926~1.EXE 2392 svchost.com 2212 1BD926~1.EXE 680 svchost.com 2992 1BD926~1.EXE 1728 svchost.com 844 1BD926~1.EXE 1600 svchost.com 1476 1BD926~1.EXE 1044 svchost.com 1832 1BD926~1.EXE 896 svchost.com 1632 1BD926~1.EXE 700 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2032 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 2032 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 1196 svchost.com 1196 svchost.com 2752 svchost.com 2752 svchost.com 2812 svchost.com 2812 svchost.com 2652 svchost.com 2652 svchost.com 2584 svchost.com 2584 svchost.com 2876 svchost.com 2876 svchost.com 2340 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 2340 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 2012 svchost.com 2012 svchost.com 2032 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 2236 svchost.com 2236 svchost.com 2032 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 1476 svchost.com 1476 svchost.com 980 svchost.com 980 svchost.com 1584 svchost.com 1584 svchost.com 2800 svchost.com 2032 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 2800 svchost.com 2396 svchost.com 2396 svchost.com 996 svchost.com 996 svchost.com 2344 svchost.com 2344 svchost.com 2316 svchost.com 2316 svchost.com 2256 svchost.com 2256 svchost.com 2156 svchost.com 2156 svchost.com 2900 svchost.com 2900 svchost.com 2536 svchost.com 2536 svchost.com 2652 svchost.com 2652 svchost.com 2828 svchost.com 2828 svchost.com 2780 svchost.com 2780 svchost.com 1360 svchost.com 1360 svchost.com 952 svchost.com 952 svchost.com 2392 svchost.com 2392 svchost.com 680 svchost.com 680 svchost.com 1728 svchost.com 1728 svchost.com 1600 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1BD926~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1BD926~1.EXE File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\directx.sys 1BD926~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\directx.sys 1BD926~1.EXE File opened for modification C:\Windows\directx.sys 1BD926~1.EXE File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\directx.sys 1BD926~1.EXE File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1BD926~1.EXE File opened for modification C:\Windows\directx.sys 1BD926~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 1BD926~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 1BD926~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 1BD926~1.EXE File opened for modification C:\Windows\directx.sys 1BD926~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD926~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2340 2032 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 31 PID 2032 wrote to memory of 2340 2032 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 31 PID 2032 wrote to memory of 2340 2032 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 31 PID 2032 wrote to memory of 2340 2032 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 31 PID 2340 wrote to memory of 1196 2340 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 32 PID 2340 wrote to memory of 1196 2340 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 32 PID 2340 wrote to memory of 1196 2340 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 32 PID 2340 wrote to memory of 1196 2340 1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe 32 PID 1196 wrote to memory of 2680 1196 svchost.com 33 PID 1196 wrote to memory of 2680 1196 svchost.com 33 PID 1196 wrote to memory of 2680 1196 svchost.com 33 PID 1196 wrote to memory of 2680 1196 svchost.com 33 PID 2680 wrote to memory of 2752 2680 1BD926~1.EXE 34 PID 2680 wrote to memory of 2752 2680 1BD926~1.EXE 34 PID 2680 wrote to memory of 2752 2680 1BD926~1.EXE 34 PID 2680 wrote to memory of 2752 2680 1BD926~1.EXE 34 PID 2752 wrote to memory of 2672 2752 svchost.com 35 PID 2752 wrote to memory of 2672 2752 svchost.com 35 PID 2752 wrote to memory of 2672 2752 svchost.com 35 PID 2752 wrote to memory of 2672 2752 svchost.com 35 PID 2672 wrote to memory of 2812 2672 1BD926~1.EXE 36 PID 2672 wrote to memory of 2812 2672 1BD926~1.EXE 36 PID 2672 wrote to memory of 2812 2672 1BD926~1.EXE 36 PID 2672 wrote to memory of 2812 2672 1BD926~1.EXE 36 PID 2812 wrote to memory of 2564 2812 svchost.com 37 PID 2812 wrote to memory of 2564 2812 svchost.com 37 PID 2812 wrote to memory of 2564 2812 svchost.com 37 PID 2812 wrote to memory of 2564 2812 svchost.com 37 PID 2564 wrote to memory of 2652 2564 1BD926~1.EXE 72 PID 2564 wrote to memory of 2652 2564 1BD926~1.EXE 72 PID 2564 wrote to memory of 2652 2564 1BD926~1.EXE 72 PID 2564 wrote to memory of 2652 2564 1BD926~1.EXE 72 PID 2652 wrote to memory of 2612 2652 svchost.com 39 PID 2652 wrote to memory of 2612 2652 svchost.com 39 PID 2652 wrote to memory of 2612 2652 svchost.com 39 PID 2652 wrote to memory of 2612 2652 svchost.com 39 PID 2612 wrote to memory of 2584 2612 1BD926~1.EXE 40 PID 2612 wrote to memory of 2584 2612 1BD926~1.EXE 40 PID 2612 wrote to memory of 2584 2612 1BD926~1.EXE 40 PID 2612 wrote to memory of 2584 2612 1BD926~1.EXE 40 PID 2584 wrote to memory of 632 2584 svchost.com 41 PID 2584 wrote to memory of 632 2584 svchost.com 41 PID 2584 wrote to memory of 632 2584 svchost.com 41 PID 2584 wrote to memory of 632 2584 svchost.com 41 PID 632 wrote to memory of 2876 632 1BD926~1.EXE 126 PID 632 wrote to memory of 2876 632 1BD926~1.EXE 126 PID 632 wrote to memory of 2876 632 1BD926~1.EXE 126 PID 632 wrote to memory of 2876 632 1BD926~1.EXE 126 PID 2876 wrote to memory of 268 2876 svchost.com 77 PID 2876 wrote to memory of 268 2876 svchost.com 77 PID 2876 wrote to memory of 268 2876 svchost.com 77 PID 2876 wrote to memory of 268 2876 svchost.com 77 PID 268 wrote to memory of 2012 268 1BD926~1.EXE 44 PID 268 wrote to memory of 2012 268 1BD926~1.EXE 44 PID 268 wrote to memory of 2012 268 1BD926~1.EXE 44 PID 268 wrote to memory of 2012 268 1BD926~1.EXE 44 PID 2012 wrote to memory of 1492 2012 svchost.com 45 PID 2012 wrote to memory of 1492 2012 svchost.com 45 PID 2012 wrote to memory of 1492 2012 svchost.com 45 PID 2012 wrote to memory of 1492 2012 svchost.com 45 PID 1492 wrote to memory of 2236 1492 1BD926~1.EXE 134 PID 1492 wrote to memory of 2236 1492 1BD926~1.EXE 134 PID 1492 wrote to memory of 2236 1492 1BD926~1.EXE 134 PID 1492 wrote to memory of 2236 1492 1BD926~1.EXE 134
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe"C:\Users\Admin\AppData\Local\Temp\1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1bd926c75e799d112871c977da1a87e5590d71deda49960036c61652133073caN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE18⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE20⤵
- Executes dropped EXE
PID:2448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE22⤵
- Executes dropped EXE
PID:1764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE24⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE26⤵
- Executes dropped EXE
PID:1292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE28⤵
- Executes dropped EXE
PID:2100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE30⤵
- Executes dropped EXE
PID:300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE32⤵
- Executes dropped EXE
PID:1180 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE36⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE38⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE42⤵
- Executes dropped EXE
PID:2164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE46⤵
- Executes dropped EXE
PID:820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE48⤵
- Executes dropped EXE
PID:268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE50⤵
- Executes dropped EXE
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE54⤵
- Executes dropped EXE
PID:2212 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE56⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE58⤵
- Executes dropped EXE
PID:844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE60⤵
- Executes dropped EXE
PID:1476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"61⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE62⤵
- Executes dropped EXE
PID:1832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"63⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE64⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE66⤵PID:864
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"67⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE68⤵PID:784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"69⤵
- Drops file in Windows directory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE70⤵
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"71⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE72⤵PID:2400
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"73⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE74⤵PID:996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"75⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE76⤵PID:1508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"77⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE78⤵PID:1516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"79⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE80⤵
- System Location Discovery: System Language Discovery
PID:2316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"81⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE82⤵PID:2736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"83⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE84⤵PID:2760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"85⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE86⤵PID:2568
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"87⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE88⤵PID:2656
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"89⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE90⤵PID:3044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"91⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE92⤵PID:1424
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"93⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE94⤵PID:1436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"95⤵
- System Location Discovery: System Language Discovery
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE96⤵PID:820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"97⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE98⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"99⤵
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE100⤵PID:912
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE102⤵PID:2292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"103⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE104⤵PID:2928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"105⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE106⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"107⤵
- Drops file in Windows directory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE108⤵PID:2112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"109⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE110⤵PID:1700
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"111⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE112⤵PID:1636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE114⤵
- Drops file in Windows directory
PID:2248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"115⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE116⤵PID:1092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"117⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE118⤵PID:2384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"119⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE120⤵
- Drops file in Windows directory
PID:984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\1BD926~1.EXE"121⤵PID:2320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-