bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
05-07-2022 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
Size

40.0MB
MD5

a7520ab8d474b169f7d70171bf1d6933
SHA1

f926802027e1290fd9df9077461697a99864ba37
SHA256

bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf
SHA512

425121d7055dd45561082dd9c481011d8f92ba49922ae265d47781f9687f4622230fc5e4624e2f26dd8e8eef8f89245dc8e5238a331495b6523f7cbf7936c6c9

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

ToDesk.exeToDesk_Service.exeToDesk.exeToDesk.exe

pid process

4100 ToDesk.exe
456 ToDesk_Service.exe
3836 ToDesk.exe
3640 ToDesk.exe

pid	process
4100	ToDesk.exe
456	ToDesk_Service.exe
3836	ToDesk.exe
3640	ToDesk.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4728-130-0x0000000000350000-0x0000000005370000-memory.dmp	upx
behavioral2/memory/4728-131-0x0000000000350000-0x0000000005370000-memory.dmp	upx
behavioral2/memory/4728-149-0x0000000000350000-0x0000000005370000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

ToDesk.exeToDesk_Service.exeToDesk.exeToDesk.exe

pid process

4100 ToDesk.exe
456 ToDesk_Service.exe
3836 ToDesk.exe
3640 ToDesk.exe

pid	process
4100	ToDesk.exe
456	ToDesk_Service.exe
3836	ToDesk.exe
3640	ToDesk.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/4728-131-0x0000000000350000-0x0000000005370000-memory.dmp	autoit_exe
behavioral2/memory/4728-149-0x0000000000350000-0x0000000005370000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

Processes:

ToDesk_Service.exe

description	ioc	process
File opened for modification	C:\Windows\System32\mmkv.default	ToDesk_Service.exe
File opened for modification	C:\Windows\System32\mmkv.default.crc	ToDesk_Service.exe

Drops file in Program Files directory 19 IoCs

Processes:

bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exeToDesk_Service.exeToDesk.exeToDesk.exe

description	ioc	process
File created	C:\Program Files (x86)\ToDesk\config.ini	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
File opened for modification	C:\Program Files (x86)\ToDesk\config.ini	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
File created	C:\Program Files (x86)\ToDesk\ToDesk_Service.exe	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
File opened for modification	C:\Program Files (x86)\ToDesk\zrtc.dll	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
File opened for modification	C:\Program Files (x86)\ToDesk\Logs\service_2022_07_05.log	ToDesk_Service.exe
File opened for modification	C:\Program Files (x86)\ToDesk\ToDesk.exe	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
File opened for modification	C:\Program Files (x86)\ToDesk\config.ini	ToDesk.exe
File opened for modification	C:\Program Files (x86)\ToDesk\Logs\sdkclient_2022_07_05.log	ToDesk.exe
File opened for modification	C:\Program Files (x86)\ToDesk\ToDesk_Service.exe	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
File created	C:\Program Files (x86)\ToDesk\ToDesk_Session.exe	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
File opened for modification	C:\Program Files (x86)\ToDesk\ToDesk_Session.exe	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
File created	C:\Program Files (x86)\ToDesk\zrtc.dll	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
File opened for modification	C:\Program Files (x86)\ToDesk\config.ini	ToDesk.exe
File opened for modification	C:\Program Files (x86)\ToDesk\Logs\zrtcservice_2022_07_05.log	ToDesk_Service.exe
File created	C:\Program Files (x86)\ToDesk\ToDesk.exe	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
File opened for modification	C:\Program Files (x86)\ToDesk\config.ini	ToDesk_Service.exe
File opened for modification	C:\Program Files (x86)\ToDesk\Logs\sdkservice_2022_07_05.log	ToDesk_Service.exe
File opened for modification	C:\Program Files (x86)\ToDesk\Logs\client_2022_07_05.log	ToDesk.exe
File opened for modification	C:\Program Files (x86)\ToDesk\Logs\zrtcclient_2022_07_05.log	ToDesk.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

ToDesk.exe

pid process

3640 ToDesk.exe

pid	process
3640	ToDesk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exeToDesk_Service.exe

pid	process
4728	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
4728	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe
456	ToDesk_Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe

pid process

4728 bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

ToDesk_Service.exeToDesk.exe

description	pid	process
Token: SeDebugPrivilege	456	ToDesk_Service.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe
Token: SeShutdownPrivilege	3640	ToDesk.exe
Token: SeCreatePagefilePrivilege	3640	ToDesk.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

ToDesk.exe

pid process

3640 ToDesk.exe
3640 ToDesk.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

ToDesk.exe

pid process

3640 ToDesk.exe
3640 ToDesk.exe

pid	process
3640	ToDesk.exe
3640	ToDesk.exe

pid	process
3640	ToDesk.exe
3640	ToDesk.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exeToDesk_Service.exe

description	pid	process	target process
PID 4728 wrote to memory of 4100	4728	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe	ToDesk.exe
PID 4728 wrote to memory of 4100	4728	bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe	ToDesk.exe
PID 456 wrote to memory of 3836	456	ToDesk_Service.exe	ToDesk.exe
PID 456 wrote to memory of 3836	456	ToDesk_Service.exe	ToDesk.exe
PID 456 wrote to memory of 3640	456	ToDesk_Service.exe	ToDesk.exe
PID 456 wrote to memory of 3640	456	ToDesk_Service.exe	ToDesk.exe

C:\Users\Admin\AppData\Local\Temp\bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe
"C:\Users\Admin\AppData\Local\Temp\bea83f2487166bc524bc5a21d6d602d5c4f0a46755d3cb0a864641f4dec7bbbf.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4728

C:\Program Files (x86)\ToDesk\ToDesk.exe
"C:\Program Files (x86)\ToDesk\ToDesk.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:4100

C:\Program Files (x86)\ToDesk\ToDesk_Service.exe
"C:\Program Files (x86)\ToDesk\ToDesk_Service.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456

C:\Program Files (x86)\ToDesk\ToDesk.exe
"C:\Program Files (x86)\ToDesk\ToDesk.exe" --hide --localPort=35600
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3836

C:\Program Files (x86)\ToDesk\ToDesk.exe
"C:\Program Files (x86)\ToDesk\ToDesk.exe" --show --localPort=35600
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ToDesk\ToDesk.exe
Filesize
27.3MB

MD5
cd9361c978359b79dcb6de8e54cdda1e

SHA1
dffc0c351b9c40940f05149feade9edebfd2be39

SHA256
7efa00883a7a4abe9d009eaae4070448e982891586e8a7ac8b060beb69eb9267

SHA512
03f072c9ae5c0014591fbf4e21732b4251fc7872ec53a71d10e635f6cd4a9b6b01d713b81e9b8efe68dd9a42d78993257a0db814a090e2967c4c84aa3fb905a8

Download Submit
C:\Program Files (x86)\ToDesk\ToDesk.exe
Filesize
27.3MB

MD5
cd9361c978359b79dcb6de8e54cdda1e

SHA1
dffc0c351b9c40940f05149feade9edebfd2be39

SHA256
7efa00883a7a4abe9d009eaae4070448e982891586e8a7ac8b060beb69eb9267

SHA512
03f072c9ae5c0014591fbf4e21732b4251fc7872ec53a71d10e635f6cd4a9b6b01d713b81e9b8efe68dd9a42d78993257a0db814a090e2967c4c84aa3fb905a8

Download Submit
C:\Program Files (x86)\ToDesk\ToDesk.exe
Filesize
27.3MB

MD5
cd9361c978359b79dcb6de8e54cdda1e

SHA1
dffc0c351b9c40940f05149feade9edebfd2be39

SHA256
7efa00883a7a4abe9d009eaae4070448e982891586e8a7ac8b060beb69eb9267

SHA512
03f072c9ae5c0014591fbf4e21732b4251fc7872ec53a71d10e635f6cd4a9b6b01d713b81e9b8efe68dd9a42d78993257a0db814a090e2967c4c84aa3fb905a8

Download Submit
C:\Program Files (x86)\ToDesk\ToDesk.exe
Filesize
27.3MB

MD5
cd9361c978359b79dcb6de8e54cdda1e

SHA1
dffc0c351b9c40940f05149feade9edebfd2be39

SHA256
7efa00883a7a4abe9d009eaae4070448e982891586e8a7ac8b060beb69eb9267

SHA512
03f072c9ae5c0014591fbf4e21732b4251fc7872ec53a71d10e635f6cd4a9b6b01d713b81e9b8efe68dd9a42d78993257a0db814a090e2967c4c84aa3fb905a8

Download Submit
C:\Program Files (x86)\ToDesk\ToDesk_Service.exe
Filesize
9.8MB

MD5
2f2478bf8d864c0620fa343272ebf449

SHA1
5f20802b568131548b07afbe37001e05057ba699

SHA256
dae138d5e1bb18a5c9256d232812cd9ceb67cd086e0fb66c38e86d5e86001551

SHA512
ab12a72fe9a07fd8e1ed3dde468e47c558006b6ee2bbbe55c29fa44f616eaa4fb967b77b1c84acd33e73ea4d31feba6a8260bdce9622f2054d992d935d22dcbf

Download Submit
C:\Program Files (x86)\ToDesk\ToDesk_Service.exe
Filesize
9.8MB

MD5
2f2478bf8d864c0620fa343272ebf449

SHA1
5f20802b568131548b07afbe37001e05057ba699

SHA256
dae138d5e1bb18a5c9256d232812cd9ceb67cd086e0fb66c38e86d5e86001551

SHA512
ab12a72fe9a07fd8e1ed3dde468e47c558006b6ee2bbbe55c29fa44f616eaa4fb967b77b1c84acd33e73ea4d31feba6a8260bdce9622f2054d992d935d22dcbf

Download Submit
C:\Program Files (x86)\ToDesk\config.ini
Filesize
80B

MD5
28a7998adc8ea8308a2c8223a61b7829

SHA1
70f4c5fb001b9750f2471885ce72fa3ee7ecfdb0

SHA256
938f8a452cb1a66ba13b08519ee2dcc0b82c8428586ce698c1f08352fbc8d1d5

SHA512
616fcacf014d10e103c21f72b2b2e39bc379a1ff25f5cffdabd3ad077597375df66851d3cf693ece9c0b01ec1ebbdf8799217c84a9416f0ad62af68232cfef6f

Download Submit
C:\Program Files (x86)\ToDesk\config.ini
Filesize
80B

MD5
28a7998adc8ea8308a2c8223a61b7829

SHA1
70f4c5fb001b9750f2471885ce72fa3ee7ecfdb0

SHA256
938f8a452cb1a66ba13b08519ee2dcc0b82c8428586ce698c1f08352fbc8d1d5

SHA512
616fcacf014d10e103c21f72b2b2e39bc379a1ff25f5cffdabd3ad077597375df66851d3cf693ece9c0b01ec1ebbdf8799217c84a9416f0ad62af68232cfef6f

Download Submit
C:\Program Files (x86)\ToDesk\config.ini
Filesize
228B

MD5
dd546ee936f0c3b45e391574861d43e3

SHA1
f8cd2238f03b9225259217b9108174f5c45b5499

SHA256
3bdbe6cc04c72d45a21e1109a808acaf6289bacfe5610eb52fae61cefa2efbc5

SHA512
6df89f47729eb5690f2c009d69125de5d36433fa6c9a4b733ef8023d542e85ee371cdf1421eaba1598fca7985069180d654228f05174e12be7285cb458345895

Download Submit
C:\Program Files (x86)\ToDesk\config.ini
Filesize
390B

MD5
0d3e7d17c8064dc99da6f7bff03ff3c3

SHA1
876462bc234568f71fdc97b12b13c9ff0d627a3e

SHA256
619233e8b65b63bca9950c8229f5fab9e54bf3ddfec93ee00fce20ce17e5da3f

SHA512
33e4f71a68590246b007158572a8cce94f61a525ba20304248b30e812a7fd2bf1e30d8ed8ccf8c0c74b53c2172a8b4efbd02c18e55000b7240527279ef0a57c0

Download Submit
C:\Program Files (x86)\ToDesk\zrtc.dll
Filesize
33.0MB

MD5
5d327b173a94edb50df15a283e22bed3

SHA1
f38d09fe9c0794a6050a4c1e8cf4cb3d17e6f41d

SHA256
ccb87d59a5f83b9253307c5ba18be999a1b3d975920d09986d740ce044c6f519

SHA512
cb56e4fbf1d2d30089151b3675b2d44685cbfc768afaa5754a7187525be595e0bfac98ac3c51faad7111071c8a8a0e8ab228ca6a5f62f026a35080ef205a4fff

Download Submit
C:\Program Files (x86)\ToDesk\zrtc.dll
Filesize
33.0MB

MD5
5d327b173a94edb50df15a283e22bed3

SHA1
f38d09fe9c0794a6050a4c1e8cf4cb3d17e6f41d

SHA256
ccb87d59a5f83b9253307c5ba18be999a1b3d975920d09986d740ce044c6f519

SHA512
cb56e4fbf1d2d30089151b3675b2d44685cbfc768afaa5754a7187525be595e0bfac98ac3c51faad7111071c8a8a0e8ab228ca6a5f62f026a35080ef205a4fff

Download Submit
C:\Program Files (x86)\ToDesk\zrtc.dll
Filesize
33.0MB

MD5
5d327b173a94edb50df15a283e22bed3

SHA1
f38d09fe9c0794a6050a4c1e8cf4cb3d17e6f41d

SHA256
ccb87d59a5f83b9253307c5ba18be999a1b3d975920d09986d740ce044c6f519

SHA512
cb56e4fbf1d2d30089151b3675b2d44685cbfc768afaa5754a7187525be595e0bfac98ac3c51faad7111071c8a8a0e8ab228ca6a5f62f026a35080ef205a4fff

Download Submit
C:\Program Files (x86)\ToDesk\zrtc.dll
Filesize
33.0MB

MD5
5d327b173a94edb50df15a283e22bed3

SHA1
f38d09fe9c0794a6050a4c1e8cf4cb3d17e6f41d

SHA256
ccb87d59a5f83b9253307c5ba18be999a1b3d975920d09986d740ce044c6f519

SHA512
cb56e4fbf1d2d30089151b3675b2d44685cbfc768afaa5754a7187525be595e0bfac98ac3c51faad7111071c8a8a0e8ab228ca6a5f62f026a35080ef205a4fff

Download Submit
C:\Program Files (x86)\ToDesk\zrtc.dll
Filesize
33.0MB

MD5
5d327b173a94edb50df15a283e22bed3

SHA1
f38d09fe9c0794a6050a4c1e8cf4cb3d17e6f41d

SHA256
ccb87d59a5f83b9253307c5ba18be999a1b3d975920d09986d740ce044c6f519

SHA512
cb56e4fbf1d2d30089151b3675b2d44685cbfc768afaa5754a7187525be595e0bfac98ac3c51faad7111071c8a8a0e8ab228ca6a5f62f026a35080ef205a4fff

Download Submit
memory/3640-145-0x0000000000000000-mapping.dmp

Download
memory/3836-142-0x0000000000000000-mapping.dmp

Download
memory/4100-132-0x0000000000000000-mapping.dmp

Download
memory/4728-130-0x0000000000350000-0x0000000005370000-memory.dmp

Filesize
80.1MB

Download
memory/4728-131-0x0000000000350000-0x0000000005370000-memory.dmp

Filesize
80.1MB

Download
memory/4728-149-0x0000000000350000-0x0000000005370000-memory.dmp

Filesize
80.1MB

Download