fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20

Analysis

Target
fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe
Size 3.8MB
Sample200901-tdb37wlp6a
SHA256 fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20
MD5 fc01bd7c34525de0ffaf784bfeb094d2
SHA1 1d6e1f03ba4d0f0d92b13ca59515777510e4fd0c
SHA512 a487519de7131357995ca45c8110a3b8b56ad2530135755601222c559c50c1ed26eccd3bd41286b29f6b3d6045c3d5d55b499dc1e0cbf582156ae6df3e728b5b
MD5 SHA1 SHA512

Score

8^/10

Drops file in Drivers directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Drivers\194E3551.sys	g6RkdiK.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe
File created	C:\Windows\SysWOW64\drivers\GmProtect.sys	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe
File created	C:\Windows\SysWOW64\drivers\GmProtect-x64.sys	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe
File created	C:\Windows\SysWOW64\drivers\g6RkdiK.exe	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe
File created	C:\Windows\SysWOW64\drivers\ProtectApi.dll	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe
File created	C:\Windows\System32\Drivers\194E3551.sys	g6RkdiK.exe

Executes dropped EXE 1 IoCs

pid	Process
852	g6RkdiK.exe

Loads dropped DLL 1 IoCs

pid	Process
852	g6RkdiK.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
612	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3836	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3836	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe
3836	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 2532	3836	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe	72
PID 3836 wrote to memory of 2532	3836	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe	72
PID 3836 wrote to memory of 2532	3836	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe	72
PID 3836 wrote to memory of 852	3836	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe	74
PID 3836 wrote to memory of 852	3836	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe	74
PID 3836 wrote to memory of 852	3836	fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe	74

C:\Users\Admin\AppData\Local\Temp\fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe
"C:\Users\Admin\AppData\Local\Temp\fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd /c rd "C:\Windows\system32\drivers\etck2HCd" /S /Q
  2⤵
  PID:2532
- C:\Windows\SysWOW64\drivers\g6RkdiK.exe
  "C:\Windows\system32\drivers\g6RkdiK.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:852