5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16

Analysis

max time kernel
170s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
Size

819KB
MD5

3fabe8f4e16f5e8b3df2992d4ba71c47
SHA1

c156a8928ddff7c1009cfcb6c87bca6a788d8d0a
SHA256

5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16
SHA512

a033a8e1b74daf7adfbe797373e1c1a9ff9a761538377de855655fc8e4350e3646e25cf870b9a4f5c16d45d5e43f7742c80ec46b8a175c84959944564cb3fa2a
SSDEEP

24576:v2O/GliJMDVMZpqa/brHkNbuvrl+YXOUs:ZUpEbzkN4xdOp

Score

9^/10

aspackv2 persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\swKxst.dll	acprotect

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Windows\Web\CDClient.exe	aspack_v212_v242
C:\windows\WEB\CDClient.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\B98561\lqqHsAA.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\B98561\lqqHsAA.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\B98561\vupJxBJ.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\B98561\vupJxBJ.dll	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

CDClient.exe

pid process

3280 CDClient.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

CDClient.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\CDClient64.sys\ImagePath = "\\??\\C:\\Windows\\CDClient64.sys"	CDClient.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\SysWOW64\swKxst.dll	upx
behavioral2/memory/3280-148-0x0000000071B30000-0x0000000071B53000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe

Loads dropped DLL 5 IoCs

Processes:

CDClient.exe

pid process

3280 CDClient.exe
3280 CDClient.exe
3280 CDClient.exe
3280 CDClient.exe
3280 CDClient.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 4 IoCs

Processes:

CDClient.exe

description	ioc	process
File created	C:\Windows\SysWOW64\175511.bat	CDClient.exe
File created	C:\Windows\SysWOW64\swKxst.dll	CDClient.exe
File created	C:\Windows\SysWOW64\8156D.dat	CDClient.exe
File created	C:\Windows\SysWOW64\091339.bat	CDClient.exe

Drops file in Windows directory 6 IoCs

Processes:

5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exeCDClient.exe

description	ioc	process
File created	C:\Windows\Web\__tmp_rar_sfx_access_check_240570796	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
File created	C:\Windows\Web\配置.txt	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
File opened for modification	C:\Windows\Web\配置.txt	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
File created	C:\Windows\Web\CDClient.exe	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
File opened for modification	C:\Windows\Web\CDClient.exe	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
File created	C:\Windows\CDClient64.sys	CDClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

CDClient.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	CDClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	CDClient.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	CDClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EA6B8534-1A67-11ED-B697-E62BBF623C53} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20db51ce74aed801	IEXPLORE.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs	CDClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b142160000000002000000000010660000000100002000000034cdc187ec6ffb111acac39b0726f950ebbc2750449cd70cf0e35e7d3e25d749000000000e8000000002000020000000ae46957a2a46028243e53a307ee8e5fc22c6bab36cab79d1e3fff169c4d4680f20000000ecd2a2b93ad5dd5093727bf13ddc33ca8cd948fd37d3c193189e12e30d3d0b1b400000008a16b005a455406fce26291b7631b3fd089e5855fb639f8c6e77b5241fe27d912ab4a844609c68b09084039ecf7ae482cdb05237181e4069d6028f8c46db13fe	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366488780"	IEXPLORE.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions	CDClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001"	CDClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000993cd97c33acff372d1cad0ab15e350459f2c94ce2648e8820b46c28915fbc84000000000e8000000002000020000000b77beb87693c04ef66b5e6fa3f81be7bfd5d52016f4f6492c12c2bd790707773200000007a9baf60acd8cfc01045809731fb108ed417cd386dc4be7ac63ee281e0fd66f940000000ca7d908d0ae329d7d07d4c4a8770da6ce41d94ee0bf4551b3f4759001a861966f9c325e8ea0e79ee99aca3b41b26faa5940d39b5057ff70ada9b3d034f8ed6e6	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c1c3cc74aed801	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

CDClient.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001"	CDClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001"	CDClient.exe

Modifies registry class 7 IoCs

Processes:

CDClient.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	CDClient.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

CDClient.exe

pid	process
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe
3280	CDClient.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

CDClient.exe

pid process

3280 CDClient.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

CDClient.exe

description	pid	process
Token: SeDebugPrivilege	3280	CDClient.exe
Token: SeLoadDriverPrivilege	3280	CDClient.exe
Token: 33	3280	CDClient.exe
Token: SeIncBasePriorityPrivilege	3280	CDClient.exe
Token: 33	3280	CDClient.exe
Token: SeIncBasePriorityPrivilege	3280	CDClient.exe
Token: 33	3280	CDClient.exe
Token: SeIncBasePriorityPrivilege	3280	CDClient.exe
Token: 33	3280	CDClient.exe
Token: SeIncBasePriorityPrivilege	3280	CDClient.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

3432 IEXPLORE.EXE

pid	process
3432	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

CDClient.execmd.execmd.execmd.execmd.execmd.execmd.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
3280	CDClient.exe
4464	cmd.exe
3280	CDClient.exe
3280	CDClient.exe
4976	cmd.exe
5024	cmd.exe
1116	cmd.exe
3676	cmd.exe
3704	cmd.exe
3984	IEXPLORE.EXE
3432	IEXPLORE.EXE
3432	IEXPLORE.EXE
3432	IEXPLORE.EXE
4616	IEXPLORE.EXE
4616	IEXPLORE.EXE
4616	IEXPLORE.EXE
4616	IEXPLORE.EXE
4616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exeCDClient.execmd.exe

description	pid	process	target process
PID 1192 wrote to memory of 3280	1192	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe	CDClient.exe
PID 1192 wrote to memory of 3280	1192	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe	CDClient.exe
PID 1192 wrote to memory of 3280	1192	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe	CDClient.exe
PID 3280 wrote to memory of 4464	3280	CDClient.exe	cmd.exe
PID 3280 wrote to memory of 4464	3280	CDClient.exe	cmd.exe
PID 3280 wrote to memory of 4464	3280	CDClient.exe	cmd.exe
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 4464 wrote to memory of 4976	4464	cmd.exe	cmd.exe
PID 4464 wrote to memory of 4976	4464	cmd.exe	cmd.exe
PID 4464 wrote to memory of 4976	4464	cmd.exe	cmd.exe
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 4464 wrote to memory of 5024	4464	cmd.exe	cmd.exe
PID 4464 wrote to memory of 5024	4464	cmd.exe	cmd.exe
PID 4464 wrote to memory of 5024	4464	cmd.exe	cmd.exe
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE
PID 3280 wrote to memory of 532	3280	CDClient.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:532

C:\Users\Admin\AppData\Local\Temp\5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
"C:\Users\Admin\AppData\Local\Temp\5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe"
2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1192

C:\windows\WEB\CDClient.exe
"C:\windows\WEB\CDClient.exe"
3⤵
- Executes dropped EXE
- Sets service image path in registry
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\091339.bat
4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B
5⤵
- Suspicious use of SetWindowsHookEx
PID:4976

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B
5⤵
- Suspicious use of SetWindowsHookEx
PID:5024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\175511.bat
4⤵
- Suspicious use of SetWindowsHookEx
PID:1116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B
5⤵
- Suspicious use of SetWindowsHookEx
PID:3676

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B
5⤵
- Suspicious use of SetWindowsHookEx
PID:3704

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
http://www.so.com
4⤵
- Suspicious use of SetWindowsHookEx
PID:3984

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.so.com
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3432

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3432 CREDAT:17410 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B98561\lqqHsAA.dll
Filesize
595KB

MD5
2f152f59468ec96a89d87c072b9cd521

SHA1
9e0bc1d43d8d5c5a97e5e72e473c682802cb092a

SHA256
085c4dd097865609fadc4aa87cd7dff89d6aca6b1bbff722abcebcde7828a453

SHA512
009973dd7ecc3d24b78b5b4536e9aeb95dee9a34a8f35006423c86cbe6b619d050b1a50a6fa2b28a160842a9738ae7e2934eb6dc30e126530d55afd2b6d1fa8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\B98561\lqqHsAA.dll
Filesize
595KB

MD5
2f152f59468ec96a89d87c072b9cd521

SHA1
9e0bc1d43d8d5c5a97e5e72e473c682802cb092a

SHA256
085c4dd097865609fadc4aa87cd7dff89d6aca6b1bbff722abcebcde7828a453

SHA512
009973dd7ecc3d24b78b5b4536e9aeb95dee9a34a8f35006423c86cbe6b619d050b1a50a6fa2b28a160842a9738ae7e2934eb6dc30e126530d55afd2b6d1fa8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\B98561\vupJxBJ.dll
Filesize
546KB

MD5
f60d60bf6a5bc518f0630857d8d602da

SHA1
810a18bacb7a2a15f056c7305f1ea4ce8a802c3b

SHA256
209b797fb8786e6b60261d3ff2bbfcb8b1cdd9698fe4707ea28f0b475bdec0a8

SHA512
9ce67959d703131837e3fe29de4dd945aa6062226a277200974c3567fbc0145b24584c13b68757fe77ce33872c5b5b42f5afc193fe4c0dc3f7e764b1218f155f

Download Submit
C:\Users\Admin\AppData\Local\Temp\B98561\vupJxBJ.dll
Filesize
546KB

MD5
f60d60bf6a5bc518f0630857d8d602da

SHA1
810a18bacb7a2a15f056c7305f1ea4ce8a802c3b

SHA256
209b797fb8786e6b60261d3ff2bbfcb8b1cdd9698fe4707ea28f0b475bdec0a8

SHA512
9ce67959d703131837e3fe29de4dd945aa6062226a277200974c3567fbc0145b24584c13b68757fe77ce33872c5b5b42f5afc193fe4c0dc3f7e764b1218f155f

Download Submit
C:\Windows\SysWOW64\091339.bat
Filesize
5KB

MD5
ad0d80bf6b4292dbada25f7f8fd6556c

SHA1
40133d1dea9905bf406fb88efcb57cd693e6cf43

SHA256
081f45a04b555b2406e5b63afbcdba4e564c3157e7d3720d21e8f53d2127bae1

SHA512
76eaacabecaaed7b4eb53fbc5db4d53b15ccdbe6526119346dc444e932cc1ebfffb74b0df3f54c85168d72082f9017802e9775bc178a58fcac0ab3c1ddb519cb

Download Submit
C:\Windows\SysWOW64\175511.bat
Filesize
5KB

MD5
ad0d80bf6b4292dbada25f7f8fd6556c

SHA1
40133d1dea9905bf406fb88efcb57cd693e6cf43

SHA256
081f45a04b555b2406e5b63afbcdba4e564c3157e7d3720d21e8f53d2127bae1

SHA512
76eaacabecaaed7b4eb53fbc5db4d53b15ccdbe6526119346dc444e932cc1ebfffb74b0df3f54c85168d72082f9017802e9775bc178a58fcac0ab3c1ddb519cb

Download Submit
C:\Windows\SysWOW64\swKxst.dll
Filesize
63KB

MD5
fd8d4e1d20d085593e26e4fb879aac1f

SHA1
dd233f681bd4807851963736fe4554e152d06793

SHA256
39c865da0e189d296eae8838d9240aefadfd63507b070fa0e6803910a51202f3

SHA512
dee6185217cf4b9bfc1fb526ec365de67294f8ddeea95eaa5f72628731b52136cc2fa703a84cf35a22a32b870bbeb1f068192336474880c03c879380e7eac317

Download Submit
C:\Windows\Web\CDClient.exe
Filesize
727KB

MD5
bae36106febed2468b3d14685936ff56

SHA1
3bbb2aa6e3fa878bd3aee18a8012073b25687b13

SHA256
68733661aa094199142075c2dc58bff437fc689c87123382ccad8fdce21f55db

SHA512
a9dc33ea5ef4e5b2a86b16f50ef97d83deb6f4461dd17c666106589126cf00ae4f877d8c2ec3ed5dd5c41c5301567ae790b6ef9b71ffeb7c2ab35fda15d61c36

Download Submit
C:\windows\WEB\CDClient.exe
Filesize
727KB

MD5
bae36106febed2468b3d14685936ff56

SHA1
3bbb2aa6e3fa878bd3aee18a8012073b25687b13

SHA256
68733661aa094199142075c2dc58bff437fc689c87123382ccad8fdce21f55db

SHA512
a9dc33ea5ef4e5b2a86b16f50ef97d83deb6f4461dd17c666106589126cf00ae4f877d8c2ec3ed5dd5c41c5301567ae790b6ef9b71ffeb7c2ab35fda15d61c36

Download Submit
memory/1116-143-0x0000000000000000-mapping.dmp

Download
memory/3280-132-0x0000000000000000-mapping.dmp

Download
memory/3280-148-0x0000000071B30000-0x0000000071B53000-memory.dmp

Filesize
140KB

Download
memory/3676-145-0x0000000000000000-mapping.dmp

Download
memory/3704-146-0x0000000000000000-mapping.dmp

Download
memory/4464-139-0x0000000000000000-mapping.dmp

Download
memory/4976-141-0x0000000000000000-mapping.dmp

Download
memory/5024-142-0x0000000000000000-mapping.dmp

Download