Malware Analysis Report

2024-11-30 21:26

Sample ID 231229-x1lgkahfbj
Target 017fef171fcb1bae625fadf3ff3a5b41
SHA256 bf60aa85ca8b3e356c3a27fa9f81014450da3e144866ed72f2f58c71e6ad2194
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bf60aa85ca8b3e356c3a27fa9f81014450da3e144866ed72f2f58c71e6ad2194

Threat Level: Known bad

The file 017fef171fcb1bae625fadf3ff3a5b41 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex payload

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-29 19:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-29 19:19

Reported

2023-12-29 19:28

Platform

win7-20231129-en

Max time kernel

130s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\017fef171fcb1bae625fadf3ff3a5b41.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\haSL\mstsc.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\XLZV\Utilman.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\f7NuFe8Q\irftp.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Groztcac = "C:\\Users\\Admin\\AppData\\Roaming\\MACROM~1\\FLASHP~1\\MACROM~1.COM\\2TMJZ\\Utilman.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\haSL\mstsc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\XLZV\Utilman.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\f7NuFe8Q\irftp.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\haSL\mstsc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\haSL\mstsc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1360 wrote to memory of 2568 N/A N/A C:\Windows\system32\mstsc.exe
PID 1360 wrote to memory of 2568 N/A N/A C:\Windows\system32\mstsc.exe
PID 1360 wrote to memory of 2568 N/A N/A C:\Windows\system32\mstsc.exe
PID 1360 wrote to memory of 2788 N/A N/A C:\Users\Admin\AppData\Local\haSL\mstsc.exe
PID 1360 wrote to memory of 2788 N/A N/A C:\Users\Admin\AppData\Local\haSL\mstsc.exe
PID 1360 wrote to memory of 2788 N/A N/A C:\Users\Admin\AppData\Local\haSL\mstsc.exe
PID 1360 wrote to memory of 2792 N/A N/A C:\Windows\system32\Utilman.exe
PID 1360 wrote to memory of 2792 N/A N/A C:\Windows\system32\Utilman.exe
PID 1360 wrote to memory of 2792 N/A N/A C:\Windows\system32\Utilman.exe
PID 1360 wrote to memory of 2184 N/A N/A C:\Users\Admin\AppData\Local\XLZV\Utilman.exe
PID 1360 wrote to memory of 2184 N/A N/A C:\Users\Admin\AppData\Local\XLZV\Utilman.exe
PID 1360 wrote to memory of 2184 N/A N/A C:\Users\Admin\AppData\Local\XLZV\Utilman.exe
PID 1360 wrote to memory of 796 N/A N/A C:\Windows\system32\irftp.exe
PID 1360 wrote to memory of 796 N/A N/A C:\Windows\system32\irftp.exe
PID 1360 wrote to memory of 796 N/A N/A C:\Windows\system32\irftp.exe
PID 1360 wrote to memory of 676 N/A N/A C:\Users\Admin\AppData\Local\f7NuFe8Q\irftp.exe
PID 1360 wrote to memory of 676 N/A N/A C:\Users\Admin\AppData\Local\f7NuFe8Q\irftp.exe
PID 1360 wrote to memory of 676 N/A N/A C:\Users\Admin\AppData\Local\f7NuFe8Q\irftp.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\017fef171fcb1bae625fadf3ff3a5b41.dll,#1

C:\Users\Admin\AppData\Local\haSL\mstsc.exe

C:\Users\Admin\AppData\Local\haSL\mstsc.exe

C:\Windows\system32\mstsc.exe

C:\Windows\system32\mstsc.exe

C:\Windows\system32\Utilman.exe

C:\Windows\system32\Utilman.exe

C:\Users\Admin\AppData\Local\XLZV\Utilman.exe

C:\Users\Admin\AppData\Local\XLZV\Utilman.exe

C:\Windows\system32\irftp.exe

C:\Windows\system32\irftp.exe

C:\Users\Admin\AppData\Local\f7NuFe8Q\irftp.exe

C:\Users\Admin\AppData\Local\f7NuFe8Q\irftp.exe

Network

N/A

Files

memory/1764-0-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1764-1-0x0000000000190000-0x0000000000197000-memory.dmp

memory/1360-3-0x00000000770B6000-0x00000000770B7000-memory.dmp

memory/1360-16-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-17-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-15-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-18-0x0000000002590000-0x0000000002597000-memory.dmp

memory/1360-26-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-28-0x0000000077450000-0x0000000077452000-memory.dmp

memory/1360-27-0x0000000077420000-0x0000000077422000-memory.dmp

memory/1360-38-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-37-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-14-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-13-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-12-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-11-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-10-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-9-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-8-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-7-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-6-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1360-4-0x00000000025B0000-0x00000000025B1000-memory.dmp

memory/1764-46-0x0000000140000000-0x0000000140122000-memory.dmp

memory/2788-56-0x00000000001B0000-0x00000000001B7000-memory.dmp

memory/2788-58-0x0000000140000000-0x0000000140124000-memory.dmp

memory/2788-54-0x0000000140000000-0x0000000140124000-memory.dmp

memory/1360-123-0x00000000770B6000-0x00000000770B7000-memory.dmp

C:\Users\Admin\AppData\Local\XLZV\DUI70.dll

MD5 78a4c4adada350ab78c8bdae21edd503
SHA1 9f768c4d084b9bef36a05a6ed1a6ee4c6f2a0ed2
SHA256 edeb7f9139aa5c13aac2d0a25fa74a131829619c917cdb1beea3ca0d77b05146
SHA512 cebd2fbe8aa66aea255ef25204382acb347fd4d084e1281da4428dd0a1aa4ee36dce09d5b5d6d4440671c430fd2779b8d91eee32a866b365071b65767a5c70d1

memory/2184-141-0x0000000140000000-0x0000000140156000-memory.dmp

memory/2184-144-0x0000000140000000-0x0000000140156000-memory.dmp

\Users\Admin\AppData\Local\XLZV\DUI70.dll

MD5 073b2775dc1ee5decc5de91c6e6f781a
SHA1 97de65c130cda9cb59f5bc43eafeb3b015ce547c
SHA256 1e5a44d735d8815c549880193f78613be5aa7016d568887df022c7e0836eebad
SHA512 7b57d3b9e6b355da5ce1221e27891cfabed9e4b5e454bd8a385ade3fee18b5bb49b21347c0547452626ab535f8a38198f958f8092760d9fd1645d631eb1afe7f

C:\Users\Admin\AppData\Local\XLZV\Utilman.exe

MD5 474c935bf1091643402a3d09757f30f9
SHA1 6d7bd9f90b9ae2f9d9078ae96eee23633f597fa1
SHA256 5a7914cac3bf2c0dca54799064f72db903eb0ec0c80f56a7a9541816ec57cdcc
SHA512 b865c7e05cb825a59cdceab97818539a18ca05377134c9d3f45c30fa2727d4b984541b16c9da82ee7561e5c38d0635e68e25c5a1b5a3e6d1ffe43f955cd80768

\Users\Admin\AppData\Local\XLZV\Utilman.exe

MD5 f51c28f087bd74bc268264585a2243a1
SHA1 4449a44e82bb83d1a7d1ad105859ce693b05e82b
SHA256 4315aee21d47fa32bcc8ac364ff35866fcfe5cd09064b21ad83f59e12da79ef7
SHA512 9d145234f8cb640f667ad5830e7538d7aab590d02eb8bebf25307c8c4a1e4da55ec052e8d2102628230071b2722ff1ba19ce7269adf0b1a3cf6265ec5a11085a

\Users\Admin\AppData\Local\f7NuFe8Q\WINMM.dll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/676-185-0x0000000000430000-0x0000000000437000-memory.dmp

memory/676-187-0x0000000140000000-0x0000000140124000-memory.dmp

C:\Users\Admin\AppData\Local\f7NuFe8Q\WINMM.dll

MD5 8601ba06c5e9f95355b3c6c319d8a186
SHA1 a5e5430c47c0779c998632caeb0972e02e626b75
SHA256 79f512db45df78d533c33526bdaf75f064b8c24dc49d5b1c8951d04b97a78317
SHA512 b30e8113bf1db320507e17843b7eaa7074387ce71285fd067474e5d546b3623cd130e91050b7c2b2b61702bfdd46232c512e13f92599db28cd0d0a102e533c0c

C:\Users\Admin\AppData\Local\f7NuFe8Q\irftp.exe

MD5 9e533dfa44971dd83d8b41872ce85aa7
SHA1 a9a2e75303b64639ea29ed479cd4c9ab08a74614
SHA256 1549c27b806996a0bb0ee2dc2ea793d9b080f47c47d5f1e8a6b66548b214a46f
SHA512 1e19ff23efb06d02bcaf97a5999942365d1399f8d433c9743a4658af51157fae4c4d0abcfd4625c34df4f8c98a46e2b1d4f9ab73de8a19e6520a1ffd263b6fd1

\Users\Admin\AppData\Local\f7NuFe8Q\irftp.exe

MD5 1fa7d8fdadf7b9756cb63860598ef18d
SHA1 fa18e3aab3852354a3dc33756464e0dde62bda43
SHA256 62b7e04d8b12eee99759daa24751bcb9fd0413fd22d8d6baee495548ffeee9f8
SHA512 c4c1a29b39a5dc9fcd1ce2d01f3ccf0b7088fac09e0af3f3f54008b9e14c3c056e44fc1e95b14e230d3fbb413507e59b170b8dc104f27aad95fea0c4a67dd348

\Users\Admin\AppData\Roaming\Mozilla\Extensions\PDfMZ6Nr\irftp.exe

MD5 cc69a0a2ec335920d0783e26c514461d
SHA1 bc7fd9b284d387fc0ce105b34b9160bf5c8d5777
SHA256 0f2e235b6dd7807a6c80df941344d32b4f1ca07f8b9c376f7560b78e9c328719
SHA512 43bacb97944afa0ab3a57b7cb34593bea38d8c626a30eb996744262e8cc49cd0beac758259cde58b7e52a15f3b8bcfcca66221f79774301720558acc25f98418

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\5i\WINMM.dll

MD5 55089f6209cdcc2f06f39ea1f5663020
SHA1 f51067be7aa740b6e6c4877e4002dfc5f4749e7d
SHA256 a7de3f813efe14853f81b382a0b19db849bdf6fcbe32d371b34c6b1073aee842
SHA512 00c05b647b8977eef013e1c3068873e0236c4bd94bb65c9e0e6caa4a0c12d8a80616d10105dd91242991d0f4490e810641367f65d96ab96f0ba5661d421fe9ed

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Aqrvnhd.lnk

MD5 00bd85e1680d973a887d9bb20258af9e
SHA1 fb6f14ce62296a68202c29bedea4f6c8ea4a594c
SHA256 b077c8d4612810ca8a13fd6cb7f5f1ac7c7b00e8f4cf73d4ce9b8b572f687d84
SHA512 b342f05cfef869fa817d119115aefbf55ecf05708bcadea41afd4e251f2309578563303c5835e17f4a497ff2fc65e5fed78fb495dbb0ef9a2220b6420af329b0

C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\2TMJZ\DUI70.dll

MD5 3cb6e6e33eb6f6170cd1178bcaa2a4f2
SHA1 0c9542ac9e43c0d0f9c0686f91a2b124adefe072
SHA256 eb56b0bf4eb3195314a036b54c95de68d6467b4e0ef8ee2899e8bb492db36dc0
SHA512 e7216c1dcd08b86f7192ac9bf713eb15e8f52c8468b4dcd4ea9948ed3d351051242730154463c0ae156c8511f4af3f4f9eee3d1f6b95f6bc548e99ef7e6e338d

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-29 19:19

Reported

2023-12-29 19:30

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\017fef171fcb1bae625fadf3ff3a5b41.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qoccyyzfzcu = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\ADMINI~1\\5cy1V\\ie4uinit.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\XNY\RecoveryDrive.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\gJBhrKG\ie4uinit.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\SbClPH\SystemPropertiesPerformance.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3592 wrote to memory of 4332 N/A N/A C:\Windows\system32\RecoveryDrive.exe
PID 3592 wrote to memory of 4332 N/A N/A C:\Windows\system32\RecoveryDrive.exe
PID 3592 wrote to memory of 3548 N/A N/A C:\Users\Admin\AppData\Local\XNY\RecoveryDrive.exe
PID 3592 wrote to memory of 3548 N/A N/A C:\Users\Admin\AppData\Local\XNY\RecoveryDrive.exe
PID 3592 wrote to memory of 1084 N/A N/A C:\Windows\system32\ie4uinit.exe
PID 3592 wrote to memory of 1084 N/A N/A C:\Windows\system32\ie4uinit.exe
PID 3592 wrote to memory of 1356 N/A N/A C:\Users\Admin\AppData\Local\gJBhrKG\ie4uinit.exe
PID 3592 wrote to memory of 1356 N/A N/A C:\Users\Admin\AppData\Local\gJBhrKG\ie4uinit.exe
PID 3592 wrote to memory of 4968 N/A N/A C:\Windows\system32\SystemPropertiesPerformance.exe
PID 3592 wrote to memory of 4968 N/A N/A C:\Windows\system32\SystemPropertiesPerformance.exe
PID 3592 wrote to memory of 1900 N/A N/A C:\Users\Admin\AppData\Local\SbClPH\SystemPropertiesPerformance.exe
PID 3592 wrote to memory of 1900 N/A N/A C:\Users\Admin\AppData\Local\SbClPH\SystemPropertiesPerformance.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\017fef171fcb1bae625fadf3ff3a5b41.dll,#1

C:\Windows\system32\RecoveryDrive.exe

C:\Windows\system32\RecoveryDrive.exe

C:\Users\Admin\AppData\Local\XNY\RecoveryDrive.exe

C:\Users\Admin\AppData\Local\XNY\RecoveryDrive.exe

C:\Windows\system32\ie4uinit.exe

C:\Windows\system32\ie4uinit.exe

C:\Users\Admin\AppData\Local\gJBhrKG\ie4uinit.exe

C:\Users\Admin\AppData\Local\gJBhrKG\ie4uinit.exe

C:\Windows\system32\SystemPropertiesPerformance.exe

C:\Windows\system32\SystemPropertiesPerformance.exe

C:\Users\Admin\AppData\Local\SbClPH\SystemPropertiesPerformance.exe

C:\Users\Admin\AppData\Local\SbClPH\SystemPropertiesPerformance.exe

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 23.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 183.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 81.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp

Files

memory/1956-0-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1956-1-0x000001767C930000-0x000001767C937000-memory.dmp

memory/3592-4-0x00007FFC8D66A000-0x00007FFC8D66B000-memory.dmp

memory/3592-3-0x0000000002870000-0x0000000002871000-memory.dmp

memory/3592-6-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-7-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-8-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-9-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-10-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-12-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-14-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-15-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-16-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-13-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-11-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-17-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-18-0x0000000002880000-0x0000000002887000-memory.dmp

memory/3592-26-0x0000000140000000-0x0000000140122000-memory.dmp

memory/3592-28-0x00007FFC8DC50000-0x00007FFC8DC60000-memory.dmp

memory/3592-27-0x00007FFC8DC60000-0x00007FFC8DC70000-memory.dmp

memory/3592-37-0x0000000140000000-0x0000000140122000-memory.dmp

memory/1956-40-0x0000000140000000-0x0000000140122000-memory.dmp

C:\Users\Admin\AppData\Local\XNY\RecoveryDrive.exe

MD5 b9b3dc6f2eb89e41ff27400952602c74
SHA1 24ae07e0db3ace0809d08bbd039db3a9d533e81b
SHA256 630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4
SHA512 7906954b881f1051a0c7f098e096bc28eddcc48643b8bf3134dd57b8c18d8beba4f9a0ac5d348de2f9b8ea607c3e9cb0e61d91e4f3ba1fefb02839f928e3e3fe

C:\Users\Admin\AppData\Local\XNY\UxTheme.dll

MD5 351cae17e932564d3c05659a10abb325
SHA1 d5a35bcdf9313542219c78f432e7114aeec78f41
SHA256 9ccd6f47882c72840fb3286ac296360b3ff5d93ace6d993cafab559e4d80db54
SHA512 59f85cd9d4d9e173e5b0e099471f2245b415c2adaeb2907dc89150330e1d10ebf865dfec454e558198331df77219ae16ed7c5b83166a3cdc6b6dae9c5df25b32

memory/3548-47-0x0000000140000000-0x0000000140123000-memory.dmp

memory/3548-48-0x000001F8C4EA0000-0x000001F8C4EA7000-memory.dmp

memory/3548-52-0x0000000140000000-0x0000000140123000-memory.dmp

C:\Users\Admin\AppData\Local\gJBhrKG\ie4uinit.exe

MD5 a2f0104edd80ca2c24c24356d5eacc4f
SHA1 8269b9fd9231f04ed47419bd565c69dc677fab56
SHA256 5d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512 e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390

C:\Users\Admin\AppData\Local\gJBhrKG\VERSION.dll

MD5 27db998b0de3973ce4c41bf650fc940c
SHA1 2ce21720ced672c5ee7d623a96368f0635b8286f
SHA256 e719be4460e73cad38598acaaaa547619f87f71ded8e27e9e713648ced307697
SHA512 319918ef6ce161930119cf3a050d2ee9ce72e38e183dfedec894fcdeba9b2929fdcf9caac826b1cc5e9bddb31d4e22050cb0de6527df0626f5c4bbd9b3f28435

memory/1356-64-0x00000221C2D50000-0x00000221C2D57000-memory.dmp

memory/1356-65-0x00000221C2B40000-0x00000221C2C63000-memory.dmp

memory/1356-69-0x00000221C2B40000-0x00000221C2C63000-memory.dmp

C:\Users\Admin\AppData\Local\gJBhrKG\ie4uinit.exe

MD5 36b9259b271be43e6a6017115758ca9b
SHA1 bbe9109887a841798beeaea4dfd4f9e3f75115cd
SHA256 fe3cd9fea41d55a2271cfb393af2f19fbf027291aa4f799bb1bda48ed47e3c37
SHA512 703cb182863f939b1d39be13732228b654d30f35a6caabcbb68c0a563c01bf3b6ab298c1fbe313b8fe1340da8d1ff3906e9483fa70f67c55b4e42ae097aa416c

C:\Users\Admin\AppData\Local\SbClPH\SystemPropertiesPerformance.exe

MD5 e4fbf7cab8669c7c9cef92205d2f2ffc
SHA1 adbfa782b7998720fa85678cc85863b961975e28
SHA256 b266318d45a4245556a2e39b763f2f11eca780969105f6f103e53dd0a492bb30
SHA512 c5c62578d04133352d6cb7b018df96a7b55c18d6111ab8bf2bfe232a3315a63b07047fa5b0b88551d152085776c66169b47566242c8c4c5e0333c55adc64e1b6

C:\Users\Admin\AppData\Local\SbClPH\SYSDM.CPL

MD5 e29b51d76623b9fe3a28905b427e77ea
SHA1 ac8d47b7718dbc27abdceacdf1c41daf6dc68448
SHA256 1fba6757b2122366043fada4c935dd73bf69084dda1401ecec0f9be7efd86a82
SHA512 22a2f2c6f13efd270adcf631b71e91aa236e9520aa78f59744ae7768aa9f7152584f3e8caa983ee8077191b154993f8b1a115638e8745104168d19edf9efccfa

C:\Users\Admin\AppData\Local\SbClPH\SYSDM.CPL

MD5 cb0cd04482bd2d1906d76beb3d716b41
SHA1 f83bcfd0f6d4ec731d61a5ade340201a98ca8134
SHA256 83e4d4d2168d0b0bd2c99a6f36c2281726c0188eeb68e34f7079a83f3fd020ef
SHA512 fef256ff500cff015eff4710dc381169ee8ee82088d0ef047fe4939b49d5d9f667b554d7e6bd1e24fe59c5a882c0c82a249e2e012903b63d2c4b8db09522ab25

memory/1900-81-0x000002BF05370000-0x000002BF05377000-memory.dmp

memory/1900-85-0x0000000140000000-0x0000000140123000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Hxquhu.lnk

MD5 d25eaa89d949cf05e47ec1c64da2c6c3
SHA1 78c21f9a80579ff83b28d294333b584c61ac9a42
SHA256 e4ed77df5299ac021252665aa15cccc5466a4f6022a99c117512b34acbbdb1be
SHA512 43755ac2e164a78a526e2c52d011d8ed4ab41584f8426d9e1c42b5146464e20e894e88e4bb2d2646e3127ab70665adf09dacdbafa8686abe1f53ee69dfa3521e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\6lV\SYSDM.CPL

MD5 5acda3ed30b57aafa725ae7ea7c27c97
SHA1 0e9bc0932fce3b3ef495bbaf9d41339275ff9785
SHA256 9d35190f8eea5ac1918352614a341aa424198ceec4c84786e67dc7c8e26ea04d
SHA512 5672f996b4a9ad55e7d06ac7895bdcdd40788eb8f5af5c18dac46a31b502ce4cbf19cc568ff8cd9e5415a3981b433ab6407a2b254552388f0f25e3315d3e6162