Malware Analysis Report

2025-08-11 01:36

Sample ID 231208-pqbklsdh3s
Target d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8
SHA256 d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8
Tags
upx vmprotect
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8

Threat Level: Likely malicious

The file d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8 was found to be: Likely malicious.

Malicious Activity Summary

upx vmprotect

Drops file in Drivers directory

Checks computer location settings

UPX packed file

Unexpected DNS network traffic destination

VMProtect packed file

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Modifies system certificate store

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-08 12:31

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-08 12:31

Reported

2023-12-08 14:05

Platform

win10v2004-20231127-en

Max time kernel

150s

Max time network

150s

Command Line

winlogon.exe

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\7GMyQH67uqGn.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\D3ZbvE1akE2.dlh C:\Windows\Explorer.EXE N/A
File created C:\Windows\System32\drivers\6NFx1aK.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\zSmIesOu2jA.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\A0QETuqBNf8t8h.sae C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\Obnrd3l1WIBKc.pbd C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\nc4JgAlptWC.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\WaOKPSLFlWNIiE.ios C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\HJ84a767XGNbXg.sys C:\Windows\Explorer.EXE N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 223.5.5.5 N/A N/A
Destination IP 114.114.114.114 N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\ \Windows\System32\E9qHN0CR.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\iuwJ3D6iFiEcFx.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\j3Dwbn7SNYLhY.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\VnDQUePMVGa.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\pIiJUUqYqOuIzg.jdg C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\HSoQVqUEG8m6KW.xmn C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\FBgXs68RamQ.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\RWpcesNqoY.njx C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\YKlxBCcECuW.snh C:\Windows\Explorer.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\gzaCZXttFvU.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\aMMt5pMuACW.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\7Y4ZkdHVwn.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Windows Sidebar\lib\646b7740.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\NgpCYiPcDKlR.gto C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\JMJiqR4AfBP2F.uef C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\0CsJ0yEPGxN.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\ieFUT7cmnbho.wqf C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\tgCRpdRjCQvuS.szx C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\zde4CFHZbpe.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\2rVj1xj7Tk13.epu C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\dotnet\47bad109.html C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\dotnet\5613613e.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\24HHU8X14W.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\vnFG9glatejo.nhm C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Windows Sidebar\47ba79c0.html C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Windows Sidebar\5612f880.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\hgNB6QmFsFwB.aon C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Windows Sidebar\3961fb00.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\4f3jLXfJLXUS.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Windows Sidebar\manifest.json C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\dotnet\manifest.json C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\dotnet\396240d4.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\dotnet\lib\646bf173.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\qY0ft26kYt.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\k4VKHF6Cm0WL.tza C:\Windows\Explorer.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\IaaLkzbZlRWDf.qqf C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\WEsEbbFbp3iyBr.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\err_4600.log C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
File opened for modification C:\Windows\CP2cZAAZhct.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\zPtTj1BYsvjj.rjx C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\MbDsrriniWEuVL.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\d0Pi5TO4333.kgx C:\Windows\Explorer.EXE N/A
File created C:\Windows\gEcB5fXw.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\2Sr5mOGu3Elk.hsz C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\qbsIAfDLHU.sys C:\Windows\Explorer.EXE N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\Explorer.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\Explorer.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\Explorer.EXE N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\dwm.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\dwm.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\dwm.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\dwm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4600 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\Explorer.EXE
PID 4600 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\Explorer.EXE
PID 4600 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\Explorer.EXE
PID 4600 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\Explorer.EXE
PID 4600 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\Explorer.EXE
PID 4600 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\system32\winlogon.exe
PID 4600 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\system32\winlogon.exe
PID 4600 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\system32\winlogon.exe
PID 4600 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\system32\winlogon.exe
PID 4600 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\system32\winlogon.exe
PID 4600 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\SysWOW64\cmd.exe
PID 4600 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\SysWOW64\cmd.exe
PID 4600 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe C:\Windows\SysWOW64\cmd.exe
PID 5024 wrote to memory of 3984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 5024 wrote to memory of 3984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 5024 wrote to memory of 3984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3120 wrote to memory of 332 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe

"C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe"

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 de108ad81976e232.vbnm34567.xyz udp
US 114.114.114.114:53 down.magiforet.cn udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 114.114.114.114.in-addr.arpa udp
US 8.8.8.8:53 225.194.19.2.in-addr.arpa udp
CN 122.189.171.115:443 down.magiforet.cn tcp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 115.171.189.122.in-addr.arpa udp
US 8.8.8.8:53 dns.alidns.com udp
CN 223.5.5.5:443 dns.alidns.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 5.5.5.223.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 114.114.114.114:53 down.zhangyaping.top udp
CN 223.5.5.5:53 dns.alidns.com udp
US 8.8.8.8:53 down.zhangyaping.top udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 yzzcommon.tyui54345.xyz udp
US 114.114.114.114:53 down.nugong.asia udp
CN 118.212.235.109:443 down.nugong.asia tcp
US 8.8.8.8:53 109.235.212.118.in-addr.arpa udp
US 8.8.8.8:53 down.nugong.asia udp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 118.212.235.109:443 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
US 8.8.8.8:53 234.50.29.218.in-addr.arpa udp
US 8.8.8.8:53 ocsp.trust-provider.cn udp
US 8.8.8.8:53 apps.game.qq.com udp
CN 101.227.134.49:443 apps.game.qq.com tcp
CN 119.36.90.164:80 ocsp.trust-provider.cn tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
NL 47.246.48.205:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 49.134.227.101.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 164.90.36.119.in-addr.arpa udp
US 8.8.8.8:53 205.48.246.47.in-addr.arpa udp
US 8.8.8.8:53 sp1.baidu.com udp
US 104.193.88.123:443 sp1.baidu.com tcp
CN 218.29.50.234:80 down.nugong.asia tcp
US 8.8.8.8:53 123.88.193.104.in-addr.arpa udp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
N/A 234.2.2.2:27878 udp
N/A 233.123.112.211:17181 udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 2.2.2.234.in-addr.arpa udp
US 8.8.8.8:53 211.112.123.233.in-addr.arpa udp
US 8.8.8.8:53 58.252.72.23.in-addr.arpa udp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
US 8.8.8.8:53 udp
CN 36.248.54.254:443 nreprot.nugong.asia tcp
US 8.8.8.8:53 udp
CN 218.29.50.234:80 nreprot.nugong.asia tcp
CN 42.192.71.187:8088 b2rpt.hjkl45678.xyz tcp
CN 218.29.50.234:80 nreprot.nugong.asia tcp
US 8.8.8.8:53 254.54.248.36.in-addr.arpa udp
US 8.8.8.8:53 187.71.192.42.in-addr.arpa udp
US 8.8.8.8:53 87.136.231.42.in-addr.arpa udp
CN 42.231.136.87:443 nreprot.nugong.asia tcp
CN 218.29.50.234:80 nreprot.nugong.asia tcp
CN 218.29.50.234:80 nreprot.nugong.asia tcp
CN 218.29.50.234:80 nreprot.nugong.asia tcp
US 8.8.8.8:53 249.194.19.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp
US 8.8.8.8:53 udp
CN 218.29.50.234:80 tcp

Files

memory/4600-0-0x00000000009C0000-0x0000000000A4C000-memory.dmp

memory/4600-15-0x00000000009C0000-0x0000000000A4C000-memory.dmp

memory/3120-22-0x0000000002690000-0x0000000002693000-memory.dmp

memory/3120-24-0x0000000002690000-0x0000000002693000-memory.dmp

memory/3120-27-0x00000000084B0000-0x0000000008561000-memory.dmp

memory/3120-29-0x00007FF8E21E0000-0x00007FF8E21F0000-memory.dmp

memory/4600-28-0x00000000009C0000-0x0000000000A4C000-memory.dmp

memory/3120-26-0x0000000002690000-0x0000000002693000-memory.dmp

memory/3120-31-0x00000000026B0000-0x00000000026B1000-memory.dmp

memory/632-33-0x00000201C3CC0000-0x00000201C3CE8000-memory.dmp

memory/3120-25-0x00000000084B0000-0x0000000008561000-memory.dmp

memory/4600-56-0x00000000009C0000-0x0000000000A4C000-memory.dmp

memory/3120-66-0x00007FF8E21E0000-0x00007FF8E21F0000-memory.dmp

memory/3120-67-0x00000000026C0000-0x00000000026C1000-memory.dmp

memory/3120-76-0x00000000026B0000-0x00000000026B1000-memory.dmp

memory/3120-75-0x00000000026E0000-0x00000000026E1000-memory.dmp

memory/3120-74-0x00000000026C0000-0x00000000026C1000-memory.dmp

memory/3120-73-0x00000000026C0000-0x00000000026C1000-memory.dmp

memory/3120-72-0x00000000026E0000-0x00000000026E1000-memory.dmp

memory/3120-71-0x00000000026F0000-0x00000000026F1000-memory.dmp

memory/3120-70-0x00000000026E0000-0x00000000026E1000-memory.dmp

memory/3120-69-0x00000000026C0000-0x00000000026C1000-memory.dmp

memory/3120-68-0x00000000084B0000-0x0000000008561000-memory.dmp

C:\Windows\CP2cZAAZhct.sys

MD5 d15f5f23df8036bd5089ce8d151b0e0d
SHA1 4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256 f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512 feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

memory/3120-81-0x0000000009070000-0x000000000911F000-memory.dmp

C:\Windows\qbsIAfDLHU.sys

MD5 f7dfe1084650949c52c95870b436b2e5
SHA1 f74784bdfd8749c3fd21cef27af46d09fc591bcb
SHA256 e5173f1190e94b0d6bad6bd01724c7100d77cce071e27f22de8480d75c439053
SHA512 65b7b3708d1f0b56d3b6dc5ff245585710401f9155210a5a25f7aa3720720988e3865c2e3096a0c590841e20f384f0e1fe135acc34ce10e07eb2231138442004

C:\Windows\MbDsrriniWEuVL.sys

MD5 64bc1983743c584a9ad09dacf12792e5
SHA1 0f14098f523d21f11129c4df09451413ddff6d61
SHA256 057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA512 9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

C:\Windows\WEsEbbFbp3iyBr.sys

MD5 a26ae0003789b5d75eb137c74c78def5
SHA1 99f378e99b0108b4fb64f833168b6de01c270999
SHA256 7938ff93eb069d2eec85f684756ad281c8f7b2a4347d1af54623cdcd847e1928
SHA512 cb0d4ae912bf74a173e38f81afe8989c9ac2661b698b06394c81cd70e0171cd9b6d48b2614094327042d8efa4c874d4394fe2e172a0cfe4a4cbe703b9e8849e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DED9969D7ED2C6E555C5C9254A43EDE4

MD5 3fefedd2d651734aab0aff2f8161db56
SHA1 eda0d013d0db080e6477965234bf4db2aceb215e
SHA256 4a2a561a396876d9ef6387f7f5394313a82d06945aae92d672a39b3db8cc5f01
SHA512 0ac825bf61b063f64e93eb4638ebeb63457309068e8a8ac27ea15b79c0ae7968ec1db6df757d74d9350abfd262d2a834ab54ee47f8d04dbb6451f7133072a56e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4

MD5 5e581fbead4712c9a3f168e844fca310
SHA1 32a6add5dde11a8d0fdd4f21896f2f30c5f6a775
SHA256 7500528923c5ffe42d033eff3661d0865c38e1128d8e1c9f3acba3e76c07ff80
SHA512 0cf5a405bcd07cdc95d6d4d0a415418018318a0f95cb657b6eb546a6b1b37bba16fb1e8acfd5d4f5d89f8d966de4bd1f37d0a144f15ca800e2081b21df2662c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

MD5 9ba47a279b7950e198b6076171704bd8
SHA1 2d40167fb1cffc590d18f00b6ae5a22a7ba2bcab
SHA256 1d855e013b588989a67757730de9fef0ae45fba49359eeeb9ca7ce03089f75c6
SHA512 d048eb90cc64e568aa36c857a19ab9d4ebbb829716ec397d91fe92ab7cf0e5addbb2928cabfdec043ed46db02b2705a079668184474c08f5e7e57d58122d83c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

MD5 ae6833043329ae231c5b448609256159
SHA1 80376c2ae86e29419115f6627ba60f3fb571bd86
SHA256 04f928644e4219c04dfd357c9bab6394dc6470268e5a22625050d31105b0496e
SHA512 0f77d31f19dc2f3aaef49402c0140196538a50636a9627dbf69c5d1b3a0b982ec7f08ff027f0ec37b0ce622d86cb605f3eec0724ebc97bbb7088e2a171453f9d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 b3e886f0a26b67c1234b30c755341758
SHA1 8a881fb559672e95834def740fc5ba017879b0db
SHA256 808b71ea8048ef6e5014fbd1dedbd496516bf963107c8dff13a53d807c60686f
SHA512 66f612ae244a65d623617290f58bd01b8db16fcb98d9b60dca78adc7b2371bfff0ad03dbb244def434e8f243efcef37337a39a30871c64dcd1f6db6e57f50524

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 978ecd6c9c9744f7af39d017b24a1be6
SHA1 7bf39547f4fc2b1e6c14c2dffc1de5133337e654
SHA256 7e08cfb38a3c28596dc6baa3339c17d32a4e5d3f6f2a994ca574c85b8f088564
SHA512 76b59484b2bd375839a3383c37a33a22f182a6e90bb07941f534e568cb7f0055a27305cb3ce50fe459a104cb8da803a50f83250859ad034ecb692ad658b57fa9

memory/332-197-0x0000024063920000-0x0000024063923000-memory.dmp

memory/332-202-0x0000024063B00000-0x0000024063B01000-memory.dmp

memory/332-201-0x0000024063940000-0x00000240639EF000-memory.dmp

memory/3120-200-0x0000000002D40000-0x0000000002D41000-memory.dmp

memory/332-199-0x0000024063A00000-0x0000024063A01000-memory.dmp

memory/332-198-0x0000024063920000-0x0000024063923000-memory.dmp

memory/3120-196-0x0000000002D40000-0x0000000002D41000-memory.dmp

memory/3120-203-0x00000000026E0000-0x00000000026E1000-memory.dmp

memory/3120-213-0x00000000026E0000-0x00000000026E1000-memory.dmp

memory/332-212-0x00000240642B0000-0x000002406435F000-memory.dmp

memory/3120-211-0x0000000002F70000-0x0000000002F71000-memory.dmp

memory/3120-210-0x000000000D140000-0x000000000D1EF000-memory.dmp

memory/3120-209-0x00000000026F0000-0x00000000026F1000-memory.dmp

memory/3120-207-0x00000000026C0000-0x00000000026C1000-memory.dmp

memory/3120-214-0x00007FF61DDD0000-0x00007FF61DDD1000-memory.dmp

memory/3120-215-0x0000000009070000-0x000000000911F000-memory.dmp

memory/332-216-0x0000024063A00000-0x0000024063A01000-memory.dmp

memory/3120-217-0x0000000009230000-0x0000000009234000-memory.dmp

memory/332-218-0x0000024063940000-0x00000240639EF000-memory.dmp

memory/3120-220-0x0000000002F70000-0x0000000002F71000-memory.dmp

memory/3120-219-0x000000000D140000-0x000000000D1EF000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-08 12:31

Reported

2023-12-08 14:05

Platform

win7-20231023-en

Max time kernel

34s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 223.5.5.5 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\err_2972.log C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe

"C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe"

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\d8b6d30644f20bbad256f8083b4bcb799b5decfa6b4c6bf7d48fea2e51a5a6a8.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 de108ad81976e232.vbnm34567.xyz udp
US 114.114.114.114:53 down.magiforet.cn udp
CN 122.189.171.115:443 down.magiforet.cn tcp
US 8.8.8.8:53 dns.alidns.com udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 114.114.114.114:53 down.zhangyaping.top udp
CN 223.5.5.5:53 dns.alidns.com udp
US 8.8.8.8:53 down.zhangyaping.top udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 yzzcommon.tyui54345.xyz udp
US 114.114.114.114:53 down.nugong.asia udp
CN 42.231.136.215:443 down.nugong.asia tcp
US 8.8.8.8:53 down.nugong.asia udp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 42.231.136.215:443 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
US 8.8.8.8:53 ocsp.trust-provider.cn udp
CN 119.36.90.164:80 ocsp.trust-provider.cn tcp
US 8.8.8.8:53 apps.game.qq.com udp
CN 101.227.134.49:443 apps.game.qq.com tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
NL 47.246.48.205:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 sp1.baidu.com udp
US 104.193.88.77:443 sp1.baidu.com tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
N/A 234.2.2.2:27878 udp
N/A 233.123.112.211:17181 udp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
CN 218.29.50.234:80 down.nugong.asia tcp
US 8.8.8.8:53 udp
CN 118.212.235.109:443 nreprot.nugong.asia tcp

Files

memory/2972-2-0x0000000000D00000-0x0000000000D8C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar4D3D.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

memory/2972-155-0x0000000000D00000-0x0000000000D8C000-memory.dmp

memory/2972-156-0x0000000000D00000-0x0000000000D8C000-memory.dmp

memory/2972-640-0x0000000000D00000-0x0000000000D8C000-memory.dmp

memory/1224-646-0x0000000002AF0000-0x0000000002AF3000-memory.dmp

memory/1224-647-0x0000000004CB0000-0x0000000004D61000-memory.dmp

memory/1224-649-0x0000000002AF0000-0x0000000002AF3000-memory.dmp

memory/420-654-0x0000000000870000-0x0000000000898000-memory.dmp

memory/1224-651-0x0000000004CB0000-0x0000000004D61000-memory.dmp

memory/1224-650-0x000007FEBF910000-0x000007FEBF920000-memory.dmp

memory/1224-644-0x0000000002AF0000-0x0000000002AF3000-memory.dmp

memory/2972-682-0x0000000000D00000-0x0000000000D8C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a778200afd260cf95c3c347d89e1f70
SHA1 2822fd32347c507fbe8e1227b0f2db71dae29c5c
SHA256 9769967e537a56a4d3b4ba592268af2befebfc597a6e0610647353b1189f88ab
SHA512 0e42c3dc37f9ce8df036be68b9786d5252f4356dc019ad7186947a1b779b0dc9c434bb1a6485b84d4c0a32e62db092296ebc60241856784555f8237fbf971629

memory/1224-707-0x00000000377D0000-0x00000000377E0000-memory.dmp

memory/1224-709-0x0000000000870000-0x0000000000898000-memory.dmp

memory/1224-710-0x0000000004CB0000-0x0000000004D61000-memory.dmp

memory/420-711-0x0000000000870000-0x0000000000898000-memory.dmp

memory/1224-716-0x00000000039C0000-0x00000000039C1000-memory.dmp

memory/1224-719-0x00000000039C0000-0x00000000039C1000-memory.dmp

memory/1224-718-0x00000000039C0000-0x00000000039C1000-memory.dmp

memory/1224-717-0x00000000039C0000-0x00000000039C1000-memory.dmp

memory/1224-715-0x00000000039C0000-0x00000000039C1000-memory.dmp

memory/1224-714-0x00000000039C0000-0x00000000039C1000-memory.dmp

memory/1224-713-0x00000000039C0000-0x00000000039C1000-memory.dmp

memory/1224-712-0x00000000039C0000-0x00000000039C1000-memory.dmp

memory/1224-721-0x0000000003AB0000-0x0000000003B5F000-memory.dmp

C:\Windows\Z5TAdfX37ujPIj.sys

MD5 d15f5f23df8036bd5089ce8d151b0e0d
SHA1 4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256 f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512 feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

C:\Windows\EmyaFqNrqiPmWl.sys

MD5 eb2688a5d3f60b3749fc4db6269e09d7
SHA1 a15107f1c1393bc1d8bb445053a7587195238871
SHA256 1088684f02079ed67f61203e0f5932484b436e790dfb8a43d17cffcf035c2aa9
SHA512 9904c7dafceda71e15da14653a0eac9623ede4cd88f54a6be0ce9d19a9b2730491b0ab0044a31de996edef12a1ae5697906de6a9bd3678814bc4026b62570ca5

C:\Windows\HDUwcwuxnhYC.sys

MD5 64bc1983743c584a9ad09dacf12792e5
SHA1 0f14098f523d21f11129c4df09451413ddff6d61
SHA256 057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA512 9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DED9969D7ED2C6E555C5C9254A43EDE4

MD5 3fefedd2d651734aab0aff2f8161db56
SHA1 eda0d013d0db080e6477965234bf4db2aceb215e
SHA256 4a2a561a396876d9ef6387f7f5394313a82d06945aae92d672a39b3db8cc5f01
SHA512 0ac825bf61b063f64e93eb4638ebeb63457309068e8a8ac27ea15b79c0ae7968ec1db6df757d74d9350abfd262d2a834ab54ee47f8d04dbb6451f7133072a56e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4

MD5 a94ba2fbadef7e0d765f09a855914a73
SHA1 7bb4b4e56fd2fc27c2b9072a720bd6d47ea39429
SHA256 cf1301a175c767e7eeb0b2cefbfed9eea01376188eea9119f685953a490730b4
SHA512 e684b93ceb62dd175aa7b24a1d753c2877ff4be464f5d37d9ecf3a87b6794396805c65c3c0f94e979b2c43d50c2079253603ff03e2d821e9c2e6bcdd4ae5e529

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

MD5 9ba47a279b7950e198b6076171704bd8
SHA1 2d40167fb1cffc590d18f00b6ae5a22a7ba2bcab
SHA256 1d855e013b588989a67757730de9fef0ae45fba49359eeeb9ca7ce03089f75c6
SHA512 d048eb90cc64e568aa36c857a19ab9d4ebbb829716ec397d91fe92ab7cf0e5addbb2928cabfdec043ed46db02b2705a079668184474c08f5e7e57d58122d83c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

MD5 f4bae28f6c27ac2939a2754ac6e39eb5
SHA1 cb660ea05989126263497854a6425589f66046f4
SHA256 715ef083b8e9fdcb5b7d82228b4e27d81ad6865407bda78a2d4435f64db8ba44
SHA512 0dd7252e1770c9fb616099f49ec885341fce928124e0977622117a172b1257d52e3bcc6c702347a29bb9e7472153913c367b1c425e704bca0928dabb2ac69458

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 b3e886f0a26b67c1234b30c755341758
SHA1 8a881fb559672e95834def740fc5ba017879b0db
SHA256 808b71ea8048ef6e5014fbd1dedbd496516bf963107c8dff13a53d807c60686f
SHA512 66f612ae244a65d623617290f58bd01b8db16fcb98d9b60dca78adc7b2371bfff0ad03dbb244def434e8f243efcef37337a39a30871c64dcd1f6db6e57f50524

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 1cb60baade60395b180cff592e18c6b0
SHA1 85f55bf8cd7ce28e7db9bea66830fce37a2e1e4c
SHA256 61c281a1db2ff28b26beeafe98d8c05a140837572b2ecb542460fe0729ea1012
SHA512 bc5fc9d4769e84fdfd67e7262d8461969a1911712981227c58ae2127bd4ac08a54a56ee340ec9bb4abd7b5f0cfd7874542807b83e2ba733dfff645f616a16bf3

C:\Windows\51nYQPrcUIE.sys

MD5 ae8b0f6f21de8de2314a2ff74e8fe49c
SHA1 76eb2832d27a0eddfd205a7ebe6469da60f3d82f
SHA256 61b87eaafbc5e4009de526d3562c19e9bc41a0a31cb76606606902c59dabec5a
SHA512 d46a19f4bbcf32770e8c77c059229d4d962156099759a4e7d12a7b9d61cb5629ef1e954a86397645c4f3ad7981c4932611cc7c07da633ba029b7de5829f693e8

memory/1224-839-0x0000000000870000-0x0000000000898000-memory.dmp

memory/1224-840-0x0000000003AB0000-0x0000000003B5F000-memory.dmp

memory/1224-841-0x0000000003A00000-0x0000000003A01000-memory.dmp

memory/1172-855-0x00000000001D0000-0x00000000001D3000-memory.dmp

memory/1172-858-0x0000000000330000-0x0000000000331000-memory.dmp

memory/1172-857-0x00000000020F0000-0x000000000219F000-memory.dmp

memory/1172-856-0x00000000001D0000-0x00000000001D3000-memory.dmp

memory/1172-851-0x00000000001D0000-0x00000000001D3000-memory.dmp

memory/1172-845-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/1172-843-0x0000000000280000-0x000000000032A000-memory.dmp

memory/1224-842-0x00000000039C0000-0x00000000039C1000-memory.dmp

memory/1224-874-0x000000000AE40000-0x000000000AEEF000-memory.dmp

memory/1224-876-0x0000000003AB0000-0x0000000003B5F000-memory.dmp

memory/1224-879-0x000000000AE40000-0x000000000AEEF000-memory.dmp

memory/1172-892-0x00000000034A0000-0x000000000354F000-memory.dmp

memory/1224-891-0x0000000003A00000-0x0000000003A01000-memory.dmp

memory/1172-889-0x0000000002520000-0x0000000002523000-memory.dmp

memory/1172-893-0x00000000020F0000-0x000000000219F000-memory.dmp

memory/1224-894-0x000000000AE40000-0x000000000AEEF000-memory.dmp