Overview

overview

7

Static

static

3

Account%20...ls.dll

windows10-2004-x64

7

Account%20...ls.dll

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 07:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Account%20statement%20details.dll
  • Size 9.3MB
  • Sample260925-hz2d3asdng
  • SHA256 d3ac10084a84dcbe0563829c1da44e02b7847bd219b8d76830d6132ee859f54a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 52 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Account%20statement%20details.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Account%20statement%20details.dll,#1
      2⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5900
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2188
          • C:\ProgramData\HvXhzMpzuQIoqaYQmuMtPsKQAznIKKCz.UrS\LFklJtPwFuKjEjIXHNetEWoKkMjZeRyc.acS.exe
            "LFklJtPwFuKjEjIXHNetEWoKkMjZeRyc.acS.exe"
            5⤵
            • Executes dropped EXE
            PID:5400
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1276
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6016
          • C:\ProgramData\yEufnLwdEmiHzTQMxgtJPUMkhjplllmg.kxb\dzwvUmayHdHKucpMaPjGzbeWVNMqHVdP.ziC.exe
            "dzwvUmayHdHKucpMaPjGzbeWVNMqHVdP.ziC.exe"
            5⤵
            • Executes dropped EXE
            PID:4540
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3164
          • C:\ProgramData\dKELlIjmttIOUAzCCCdTmAbpHNcupEWc.hxS\YuKAmSpiBHAzxKSxQIjrmSojeFoyvAJr.pnf.exe
            "YuKAmSpiBHAzxKSxQIjrmSojeFoyvAJr.pnf.exe"
            5⤵
            • Executes dropped EXE
            PID:5492
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2116
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2276
          • C:\ProgramData\pBkLeqjIDswweuUlxsYHRALWGAwrbFMU.WSw\jtlreRORmuEeIKXAYjyFoZeKtBAJYCwo.viR.exe
            "jtlreRORmuEeIKXAYjyFoZeKtBAJYCwo.viR.exe"
            5⤵
            • Executes dropped EXE
            PID:2448
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5456
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4700
          • C:\ProgramData\xRuvfOueLyyeCtMixVaxKaSVpkJwznRU.xaN\meBmPXomMOoAbWLMUwYuLZSsszogIfrF.agu.exe
            "meBmPXomMOoAbWLMUwYuLZSsszogIfrF.agu.exe"
            5⤵
            • Executes dropped EXE
            PID:5772
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5380
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2608
          • C:\ProgramData\JbynIPuPkVerTluJsnWceDUbVYjGmeXW.Bhk\MQFedXYtkcbroWGCuajEwdXHQiiHCDcd.IpU.exe
            "MQFedXYtkcbroWGCuajEwdXHQiiHCDcd.IpU.exe"
            5⤵
            • Executes dropped EXE
            PID:5444
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4036
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5324
          • C:\ProgramData\hoRWwnfLTDbwoEGnngSDIphSlTXURjtM.vre\knQelqkQEFrjTXYhjviDSROvcWZwoJYm.lUR.exe
            "knQelqkQEFrjTXYhjviDSROvcWZwoJYm.lUR.exe"
            5⤵
            • Executes dropped EXE
            PID:5888
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5196
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4696
          • C:\ProgramData\LcUISxDwehztdhpdKrEwxlHZvUwYoXOP.hIQ\BOhQcioJujsTpAihzhLXtDuwfbckXSBh.aLl.exe
            "BOhQcioJujsTpAihzhLXtDuwfbckXSBh.aLl.exe"
            5⤵
            • Executes dropped EXE
            PID:4904
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1784
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4760
          • C:\ProgramData\kTHvoZCcHMmEUQKaWvKMJrsfHlWSSXpb.Gtv\KgadHwiRvptWunbRepTioCDqBIogBTvW.wCb.exe
            "KgadHwiRvptWunbRepTioCDqBIogBTvW.wCb.exe"
            5⤵
            • Executes dropped EXE
            PID:5064
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5764
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2064
          • C:\ProgramData\drtqisuzQhLwzdCgEGIJEwPfhjwAMBPs.AGj\zpUMrdWjfomftADtbpKYxsUTaNGQgiAx.BuX.exe
            "zpUMrdWjfomftADtbpKYxsUTaNGQgiAx.BuX.exe"
            5⤵
            • Executes dropped EXE
            PID:2880
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1244
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6124
          • C:\ProgramData\kiUpriHJBWnDhXYutVZTYbQUVgvUpdlO.Fwl\XhLZiVfmYlpXWHCjfDeLzVMYkMvZmBTV.Uxz.exe
            "XhLZiVfmYlpXWHCjfDeLzVMYkMvZmBTV.Uxz.exe"
            5⤵
            • Executes dropped EXE
            PID:3744
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3904
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1512
          • C:\ProgramData\bUvZGgqvrjmjAUwiAlrbfYTIDKKJfkli.PlE\MIggLrofjHjYIVGLncFhfAsFZatNTyql.IJD.exe
            "MIggLrofjHjYIVGLncFhfAsFZatNTyql.IJD.exe"
            5⤵
            • Executes dropped EXE
            PID:1040
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5784
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6036
          • C:\ProgramData\EcounBhaNfFJEjOUKWiXNNlTIXwSketg.VOr\JQXLeWVicVFcYrZOucUBcTYBBFoUIDVk.qAv.exe
            "JQXLeWVicVFcYrZOucUBcTYBBFoUIDVk.qAv.exe"
            5⤵
            • Executes dropped EXE
            PID:2668
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2868
          • C:\ProgramData\iJclVEKLINRuNowzjGitHkcQBErHiyEv.nZC\VOEGGXayBrtYDqAKdqwTquvLumAAPEhp.Ctv.exe
            "VOEGGXayBrtYDqAKdqwTquvLumAAPEhp.Ctv.exe"
            5⤵
            • Executes dropped EXE
            PID:5284
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4992
          • C:\ProgramData\GcEmvHixQAvnJJmUzKNtsPlGbBeWVCsv.WnF\uEiBEtMfkoVbdGZiEjFNSmAehgUobJAT.UQp.exe
            "uEiBEtMfkoVbdGZiEjFNSmAehgUobJAT.UQp.exe"
            5⤵
            • Executes dropped EXE
            PID:2176
      • C:\ProgramData\QQGCzBBQQKvZlfruzQiFRHhauVChLoUi.XIF\rypXgNEZOUuGjxLmCjGSuixjCkwCEzbu.QYo.exe
        "C:\ProgramData\QQGCzBBQQKvZlfruzQiFRHhauVChLoUi.XIF\rypXgNEZOUuGjxLmCjGSuixjCkwCEzbu.QYo.exe"
        3⤵
        • Executes dropped EXE
        PID:1828
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5320
          • C:\ProgramData\sIPAusCIrceFPoeeRLdsivXVoUUNAMwz.uNx\nAfOCOQIyohXrKEsXmhVgpvhcRQVDDQt.OMz.exe
            "nAfOCOQIyohXrKEsXmhVgpvhcRQVDDQt.OMz.exe"
            5⤵
            • Executes dropped EXE
            PID:4304
      • C:\ProgramData\ImfapyeHBLJeYzEvKwGAjBHBGoiUntkG.beo\FrRIUaBroUeiRKuIVCLzieSZrfRvMGvj.vGq.exe
        "C:\ProgramData\ImfapyeHBLJeYzEvKwGAjBHBGoiUntkG.beo\FrRIUaBroUeiRKuIVCLzieSZrfRvMGvj.vGq.exe"
        3⤵
        • Executes dropped EXE
        PID:6000
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:520
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4560
          • C:\ProgramData\IExaduSOgAMeLNAyuSjmRlCNJPgDOOBH.rZZ\xGcOJSBfwrVTHtZdjhaenzeLLsCehCEz.vAY.exe
            "xGcOJSBfwrVTHtZdjhaenzeLLsCehCEz.vAY.exe"
            5⤵
            • Executes dropped EXE
            PID:3516
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4956
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5660
          • C:\ProgramData\ynzaZuXYPXsIReKUpoiPJSjCbaZInyoy.AOb\glwlqbHJjHAwrrpgQIHWKMwrlYvYyUiZ.FPR.exe
            "glwlqbHJjHAwrrpgQIHWKMwrlYvYyUiZ.FPR.exe"
            5⤵
            • Executes dropped EXE
            PID:5096
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1324
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4484
          • C:\ProgramData\RtPxPcAGajZadNlHuJiJLNwsgWLQTXHI.tlS\tzjApNXlnedKyHBwuNiUIpVMlDNgquRs.htI.exe
            "tzjApNXlnedKyHBwuNiUIpVMlDNgquRs.htI.exe"
            5⤵
            • Executes dropped EXE
            PID:2924
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5780
          • C:\ProgramData\jbaUCirsJZUfoAPvXfZVaaUSNgCbSKmB.sVy\CpEAnKfLmItzJXoUCxwYoymyHirEgbih.AQD.exe
            "CpEAnKfLmItzJXoUCxwYoymyHirEgbih.AQD.exe"
            5⤵
            • Executes dropped EXE
            PID:4632
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:840
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2060
          • C:\ProgramData\BtIWEqTnXxXYcSsWssYcmJtyjuiJhSud.BCw\XVxiWgbfKaNqWQDYqJKIsvgxHLCTZfTP.QdH.exe
            "XVxiWgbfKaNqWQDYqJKIsvgxHLCTZfTP.QdH.exe"
            5⤵
            • Executes dropped EXE
            PID:5508
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        PID:3528
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5888
          • C:\ProgramData\sobVjtnHNZJFWoWjsOsqgqrMPhwisTrg.iFJ\kSqhOTEfKTOnYSIZcLvAosUZyzTjfGnz.OkS.exe
            "kSqhOTEfKTOnYSIZcLvAosUZyzTjfGnz.OkS.exe"
            5⤵
            • Executes dropped EXE
            PID:432
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1456
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5020
          • C:\ProgramData\GrdzEtFujKchxSmjVnGMBdtbpxKWOCvU.ZFe\sIcaQnjNcQLLyrDSsNNbLdSqoJZhJYpy.PnB.exe
            "sIcaQnjNcQLLyrDSsNNbLdSqoJZhJYpy.PnB.exe"
            5⤵
            • Executes dropped EXE
            PID:3108
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2528
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
            PID:972
            • C:\ProgramData\ftfDIVhsBrXKHNRVRmrHLoXkjSwhisXh.jrO\FsrmmluFTvxbnEgSYkGPQdOhxqKOvKsp.eAh.exe
              "FsrmmluFTvxbnEgSYkGPQdOhxqKOvKsp.eAh.exe"
              5⤵
              • Executes dropped EXE
              PID:4456
        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3264
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1468
            • C:\ProgramData\wNoronOARjIAhTeMPbGXeRHdJgZdnMYT.poF\semUMopPJaJonQZFwDnrIBPRPcoISDxr.ouP.exe
              "semUMopPJaJonQZFwDnrIBPRPcoISDxr.ouP.exe"
              5⤵
              • Executes dropped EXE
              PID:2784
        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Executes dropped EXE
          PID:1892
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3376
            • C:\ProgramData\QITusmmJzmxYEFOfyviijMcpgKtYtuyC.vLQ\kWIPhShSXYvQSIECEfqhQZstSipoJyMO.hYq.exe
              "kWIPhShSXYvQSIECEfqhQZstSipoJyMO.hYq.exe"
              5⤵
              • Executes dropped EXE
              PID:3104
        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2772
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
              PID:5312
              • C:\ProgramData\OmtWpdKSEyAklvMQYpWSPvAsciqtAzGu.xhI\WTknjRqKhirPGWLdkOJOMjLZVfAkwptv.WGd.exe
                "WTknjRqKhirPGWLdkOJOMjLZVfAkwptv.WGd.exe"
                5⤵
                • Executes dropped EXE
                PID:4724
          • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • Executes dropped EXE
            PID:5836
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2236
              • C:\ProgramData\jUHvZEktRsidmMFqdfKdHoLKQRVwduMc.yyY\ARTBCDwGmNasWWgZIbNWCCgQiBnyIemv.ULV.exe
                "ARTBCDwGmNasWWgZIbNWCCgQiBnyIemv.ULV.exe"
                5⤵
                • Executes dropped EXE
                PID:2612
          • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:940
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4324
              • C:\ProgramData\mRvjuziohykChMfIADYIIVqwikDDUUTN.NZO\GgtDJoYuFEmrgooSunMvUcKJdwjKDikp.EFg.exe
                "GgtDJoYuFEmrgooSunMvUcKJdwjKDikp.EFg.exe"
                5⤵
                • Executes dropped EXE
                PID:4436
          • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • Executes dropped EXE
            PID:3028
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3352
              • C:\ProgramData\eclqzrMotXMdRrHmBxPEzWxpjELvsgvJ.KPe\XPUWWaIyeiytLqQFnWkRfyfoHWWGZQCJ.Cwn.exe
                "XPUWWaIyeiytLqQFnWkRfyfoHWWGZQCJ.Cwn.exe"
                5⤵
                • Executes dropped EXE
                PID:4344
          • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1116
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2464
              • C:\ProgramData\yoAzgmRgEyuCnKDdpfIoLtSPvLAhFEUh.nmf\GNbzysEvpYsbBqtdKOEOLLCFSicjQGnW.VTQ.exe
                "GNbzysEvpYsbBqtdKOEOLLCFSicjQGnW.VTQ.exe"
                5⤵
                  PID:2576
            • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5316
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4308
                • C:\ProgramData\xvIybeqbaxIgQpiDPWLwNOZtnZqGzXmM.mVN\acPVzMtGtjQChGjmglFpxKdHzpduSWXg.pWa.exe
                  "acPVzMtGtjQChGjmglFpxKdHzpduSWXg.pWa.exe"
                  5⤵
                    PID:1868
              • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5108
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:6020
                  • C:\ProgramData\aBBlKOVKzQobbHmKIIljdQOSqILPDEWw.GOt\LPvvETCzVSUMDDfLnXICqBgQknoUEMmV.fSq.exe
                    "LPvvETCzVSUMDDfLnXICqBgQknoUEMmV.fSq.exe"
                    5⤵
                      PID:3472
                • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                  /c "C:\Windows\System32\ComputerDefaults.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3356
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2792
                    • C:\ProgramData\ORahiNDsdPDnliMWqeoNEnmLNMqALrff.jpN\DwJvNAWepmgDUIHhvZaYQQEtgjrjuLdh.dRO.exe
                      "DwJvNAWepmgDUIHhvZaYQQEtgjrjuLdh.dRO.exe"
                      5⤵
                        PID:460
                  • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1588
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4364
                      • C:\ProgramData\YKDorhJbjXnOYrktyLRBYvwcawAbGuDN.pwm\IOePxYmTyazGKiHHsZdPRkKtLiYSZxeN.rXe.exe
                        "IOePxYmTyazGKiHHsZdPRkKtLiYSZxeN.rXe.exe"
                        5⤵
                          PID:2804
                    • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:5492
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1400
                        • C:\ProgramData\yxhAiFrnNTCerqBfVNpFHmmrHtGSmmFl.Vem\fQpRmeLlQbpkJoqEIDaGuVpJUlfGkJBV.mVs.exe
                          "fQpRmeLlQbpkJoqEIDaGuVpJUlfGkJBV.mVs.exe"
                          5⤵
                            PID:2376
                      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3864
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2380
                          • C:\ProgramData\PYNPTJLpDSscizJmXNDBAJwDAAPscSOu.wyq\SaLVjRBFRayFHPhiQJoCfLYaWqTHsklH.gwF.exe
                            "SaLVjRBFRayFHPhiQJoCfLYaWqTHsklH.gwF.exe"
                            5⤵
                              PID:4732
                        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3644
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                              PID:2748
                              • C:\ProgramData\FuxHOgPftQPWMztlePyPRdySgefMpBUS.QNb\OGSiDVTiGgoqXlzDZMnlbxWvTABSPnXS.EdY.exe
                                "OGSiDVTiGgoqXlzDZMnlbxWvTABSPnXS.EdY.exe"
                                5⤵
                                  PID:4220
                            • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                              /c "C:\Windows\System32\ComputerDefaults.exe"
                              3⤵
                                PID:3920
                                • C:\Windows\SysWOW64\ComputerDefaults.exe
                                  C:\Windows\System32\ComputerDefaults.exe
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3364
                                  • C:\ProgramData\MUaYGXmYELFInoWVIZNvvqbYLhTSCmKS.YRW\iNFRXtNgMTpJowErSkQvdCEClgVMrcrO.QEz.exe
                                    "iNFRXtNgMTpJowErSkQvdCEClgVMrcrO.QEz.exe"
                                    5⤵
                                      PID:4600
                                • C:\ProgramData\MUaYGXmYELFInoWVIZNvvqbYLhTSCmKS.YRW\iNFRXtNgMTpJowErSkQvdCEClgVMrcrO.QEz.exe
                                  "C:\ProgramData\MUaYGXmYELFInoWVIZNvvqbYLhTSCmKS.YRW\iNFRXtNgMTpJowErSkQvdCEClgVMrcrO.QEz.exe"
                                  3⤵
                                    PID:4632
                              • C:\ProgramData\IjKGZa.EdQ\78769797.bskU
                                C:\ProgramData\IjKGZa.EdQ\78769797.bskU
                                1⤵
                                • Executes dropped EXE
                                PID:1164
                              • C:\ProgramData\IjKGZa.EdQ\5622421874.Uwo
                                C:\ProgramData\IjKGZa.EdQ\5622421874.Uwo
                                1⤵
                                • Executes dropped EXE
                                PID:3636

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    LFklJtPwFuKjEjIXHNetEWoKkMjZeRyc.acS.exe
                                    • Path C:\ProgramData\HvXhzMpzuQIoqaYQmuMtPsKQAznIKKCz.UrS\LFklJtPwFuKjEjIXHNetEWoKkMjZeRyc.acS.exe
                                    • Size 51KB
                                    • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    5622421874.Uwo
                                    • Path C:\ProgramData\IjKGZa.EdQ\5622421874.Uwo
                                    • Size 32KB
                                    • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    5622421874.Uwo.ppt
                                    • Path C:\ProgramData\IjKGZa.EdQ\5622421874.Uwo.ppt
                                    • Size 32KB
                                    • SHA256 5bb44bb2a9735b9b71e649635474cdae602e4f3c898ecfc4717cc7fea11e8570
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    78769797.bskU
                                    • Path C:\ProgramData\IjKGZa.EdQ\78769797.bskU
                                    • Size 17KB
                                    • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    78769797.bskU.ppt
                                    • Path C:\ProgramData\IjKGZa.EdQ\78769797.bskU.ppt
                                    • Size 17KB
                                    • SHA256 4df92dda94bde425df050a679eb5774be2f8fabaa1c3f5e1618a247c7f87a139
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    CMD.EXE
                                    • Path C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                                    • Size 247KB
                                    • SHA256 66c09b9350a906c30d45cf00e8193c6a65862736aceb55ef8c9eb6f2b1aeca53
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/1164-4-0x0000000000010000-0x0000000000017000-memory.dmp
                                    Download