Malware Analysis Report

2024-11-30 21:47

Sample ID 231230-3q2npafdcj
Target 206ea879e170ed48d44d695164656e2f
SHA256 ec42ad2ee58810c9ac2d26526197e38dc316b146b5d20ef254c5ab949c972dad
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ec42ad2ee58810c9ac2d26526197e38dc316b146b5d20ef254c5ab949c972dad

Threat Level: Known bad

The file 206ea879e170ed48d44d695164656e2f was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Adds Run key to start application

Unsigned PE

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-30 23:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-30 23:43

Reported

2024-01-01 13:07

Platform

win7-20231215-en

Max time kernel

150s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\206ea879e170ed48d44d695164656e2f.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\HyM28nJ\Netplwiz.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\LfrNqfj\fveprompt.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\nTFIs6mA\wisptis.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zqonzshwxyr = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\krR19v\\fveprompt.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\HyM28nJ\Netplwiz.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\LfrNqfj\fveprompt.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\nTFIs6mA\wisptis.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1348 wrote to memory of 2728 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 1348 wrote to memory of 2728 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 1348 wrote to memory of 2728 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 1348 wrote to memory of 2804 N/A N/A C:\Users\Admin\AppData\Local\HyM28nJ\Netplwiz.exe
PID 1348 wrote to memory of 2804 N/A N/A C:\Users\Admin\AppData\Local\HyM28nJ\Netplwiz.exe
PID 1348 wrote to memory of 2804 N/A N/A C:\Users\Admin\AppData\Local\HyM28nJ\Netplwiz.exe
PID 1348 wrote to memory of 2544 N/A N/A C:\Windows\system32\fveprompt.exe
PID 1348 wrote to memory of 2544 N/A N/A C:\Windows\system32\fveprompt.exe
PID 1348 wrote to memory of 2544 N/A N/A C:\Windows\system32\fveprompt.exe
PID 1348 wrote to memory of 1092 N/A N/A C:\Users\Admin\AppData\Local\LfrNqfj\fveprompt.exe
PID 1348 wrote to memory of 1092 N/A N/A C:\Users\Admin\AppData\Local\LfrNqfj\fveprompt.exe
PID 1348 wrote to memory of 1092 N/A N/A C:\Users\Admin\AppData\Local\LfrNqfj\fveprompt.exe
PID 1348 wrote to memory of 752 N/A N/A C:\Windows\system32\wisptis.exe
PID 1348 wrote to memory of 752 N/A N/A C:\Windows\system32\wisptis.exe
PID 1348 wrote to memory of 752 N/A N/A C:\Windows\system32\wisptis.exe
PID 1348 wrote to memory of 2184 N/A N/A C:\Users\Admin\AppData\Local\nTFIs6mA\wisptis.exe
PID 1348 wrote to memory of 2184 N/A N/A C:\Users\Admin\AppData\Local\nTFIs6mA\wisptis.exe
PID 1348 wrote to memory of 2184 N/A N/A C:\Users\Admin\AppData\Local\nTFIs6mA\wisptis.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\206ea879e170ed48d44d695164656e2f.dll,#1

C:\Windows\system32\Netplwiz.exe

C:\Windows\system32\Netplwiz.exe

C:\Users\Admin\AppData\Local\HyM28nJ\Netplwiz.exe

C:\Users\Admin\AppData\Local\HyM28nJ\Netplwiz.exe

C:\Windows\system32\fveprompt.exe

C:\Windows\system32\fveprompt.exe

C:\Users\Admin\AppData\Local\LfrNqfj\fveprompt.exe

C:\Users\Admin\AppData\Local\LfrNqfj\fveprompt.exe

C:\Windows\system32\wisptis.exe

C:\Windows\system32\wisptis.exe

C:\Users\Admin\AppData\Local\nTFIs6mA\wisptis.exe

C:\Users\Admin\AppData\Local\nTFIs6mA\wisptis.exe

Network

N/A

Files

memory/1700-0-0x0000000000190000-0x0000000000197000-memory.dmp

memory/1700-1-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-4-0x0000000076C26000-0x0000000076C27000-memory.dmp

memory/1348-5-0x00000000025C0000-0x00000000025C1000-memory.dmp

memory/1700-8-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-7-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-9-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-10-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-11-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-13-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-12-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-14-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-15-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-16-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-18-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-19-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-17-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-20-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-21-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-22-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-23-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-24-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-25-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-26-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-27-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-28-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-29-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-30-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-31-0x0000000002590000-0x0000000002597000-memory.dmp

memory/1348-38-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-39-0x0000000076E31000-0x0000000076E32000-memory.dmp

memory/1348-40-0x0000000076F90000-0x0000000076F92000-memory.dmp

memory/1348-49-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1348-55-0x0000000140000000-0x0000000140161000-memory.dmp

\Users\Admin\AppData\Local\HyM28nJ\Netplwiz.exe

MD5 e43ec3c800d4c0716613392e81fba1d9
SHA1 37de6a235e978ecf3bb0fc2c864016c5b0134348
SHA256 636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c
SHA512 176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08

C:\Users\Admin\AppData\Local\HyM28nJ\NETPLWIZ.dll

MD5 e5c944c581523ec6cb7c76091e2a7356
SHA1 fa5f6614a8959402f51d70e9f7b750e7f9cdbc65
SHA256 06cacc086d3cc0bf8ca63183b6babd0421b65eb6e6e8c9d6d793f2162dac2dd5
SHA512 3ee97bc6196b355b1dd6b8da70457f8840bacbb45ef00d8b13db6f568caaef0d54d1edac2e5c26e5a4e5464db47a10300bdea0193d13aabf90ca2ccb09b2b325

memory/2804-68-0x0000000140000000-0x0000000140162000-memory.dmp

memory/2804-67-0x00000000000F0000-0x00000000000F7000-memory.dmp

memory/2804-73-0x0000000140000000-0x0000000140162000-memory.dmp

C:\Users\Admin\AppData\Local\LfrNqfj\fveprompt.exe

MD5 dc2c44a23b2cd52bd53accf389ae14b2
SHA1 e36c7b6f328aa2ab2f52478169c52c1916f04b5f
SHA256 7f5b19f2c6a94833196ee1929d48094889b33b504d73d3af88dd857ceaf67921
SHA512 ff083f74777a9cfc940d4e0cb55886397e27c85f867de9a5dd9ea2c2751d2a77bf75fe0734e424d9678c83e927788d07d0b3072024f7e5a9848c7ff1aa4090dc

C:\Users\Admin\AppData\Local\LfrNqfj\slc.dll

MD5 55351848e41dc980d8340730a03023c9
SHA1 33a25cd77175024687731e7198a179420c565641
SHA256 0ee0893a921dd83a0286ba2bf1944940132403c14995649cb861f78fab5bca9f
SHA512 008cba1935bfcdc4dd77b4dbf046d2eead8db99d82babf2bb1b013fa16406791efa4a304a70ca351a6e8928d6adc05593cec17130835f7ce75db6a89fb16cf34

memory/1092-85-0x0000000000100000-0x0000000000107000-memory.dmp

memory/1092-91-0x0000000140000000-0x0000000140162000-memory.dmp

\Users\Admin\AppData\Local\nTFIs6mA\wisptis.exe

MD5 02e20372d9d6d28e37ba9704edc90b67
SHA1 d7d18ba0df95c3507bf20be8d72e25c5d11ab40c
SHA256 3338129ddf6fb53d6e743c10bc39ec372d9b2c39c607cbe8a71cff929f854144
SHA512 bcad8894614dcfc1429be04829c217e7c8ac3c40ea3927073de3421d96d9815739ee1b84f0200eb18b3b8406b972bd934204b7b31638c9fe7c297fb201ed4200

C:\Users\Admin\AppData\Local\nTFIs6mA\MAGNIFICATION.dll

MD5 46dd6c0102fa82b054e00e2cadb039ab
SHA1 19ee3ede3403846d408c171096e2796e54f0b48f
SHA256 76fbda437d37df880972dbce66403d2bc62e53b6f90e16427cd50976779c62ff
SHA512 8d5fdaf1d6bb8d81e4796036f8c0edb546c540e3a77fd45ee25154cd57d813507e9def545ba95d9bf275cc5513959a7abf9bdaa471eb678b5c827fdb3e8bbd12

memory/2184-108-0x0000000140000000-0x0000000140162000-memory.dmp

memory/1348-124-0x0000000076C26000-0x0000000076C27000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

MD5 079ec8ad153408a85fb9c607db5d769f
SHA1 63748c02a9e4d3650a8fadcd0d2b5dd2d84475b4
SHA256 147a0f96d67d6ea4d43f4bcd21a1a0be2df4fae6e4352c2045cdf88f19390b53
SHA512 0ee6f25c4ddd8f0b0407a651c28ee466d388ce7825c5ad4d8a113f73831158267c0bc87efa09facfeb0b56a3f2be67409ba54836a495cbf74f9ec88cce50f2b1

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-30 23:43

Reported

2024-01-01 13:09

Platform

win10v2004-20231222-en

Max time kernel

150s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\206ea879e170ed48d44d695164656e2f.dll,#1

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tgnmvdx = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\9dwe\\sethc.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\VEZH\recdisc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\X2Qak6OY\sethc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\I2Dz\msinfo32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ N/A N/A
Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3476 wrote to memory of 1084 N/A N/A C:\Windows\system32\recdisc.exe
PID 3476 wrote to memory of 1084 N/A N/A C:\Windows\system32\recdisc.exe
PID 3476 wrote to memory of 2580 N/A N/A C:\Users\Admin\AppData\Local\VEZH\recdisc.exe
PID 3476 wrote to memory of 2580 N/A N/A C:\Users\Admin\AppData\Local\VEZH\recdisc.exe
PID 3476 wrote to memory of 3776 N/A N/A C:\Windows\system32\sethc.exe
PID 3476 wrote to memory of 3776 N/A N/A C:\Windows\system32\sethc.exe
PID 3476 wrote to memory of 4860 N/A N/A C:\Users\Admin\AppData\Local\X2Qak6OY\sethc.exe
PID 3476 wrote to memory of 4860 N/A N/A C:\Users\Admin\AppData\Local\X2Qak6OY\sethc.exe
PID 3476 wrote to memory of 1804 N/A N/A C:\Windows\system32\msinfo32.exe
PID 3476 wrote to memory of 1804 N/A N/A C:\Windows\system32\msinfo32.exe
PID 3476 wrote to memory of 2004 N/A N/A C:\Users\Admin\AppData\Local\I2Dz\msinfo32.exe
PID 3476 wrote to memory of 2004 N/A N/A C:\Users\Admin\AppData\Local\I2Dz\msinfo32.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\206ea879e170ed48d44d695164656e2f.dll,#1

C:\Windows\system32\recdisc.exe

C:\Windows\system32\recdisc.exe

C:\Users\Admin\AppData\Local\VEZH\recdisc.exe

C:\Users\Admin\AppData\Local\VEZH\recdisc.exe

C:\Users\Admin\AppData\Local\X2Qak6OY\sethc.exe

C:\Users\Admin\AppData\Local\X2Qak6OY\sethc.exe

C:\Windows\system32\msinfo32.exe

C:\Windows\system32\msinfo32.exe

C:\Windows\system32\sethc.exe

C:\Windows\system32\sethc.exe

C:\Users\Admin\AppData\Local\I2Dz\msinfo32.exe

C:\Users\Admin\AppData\Local\I2Dz\msinfo32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 146.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 211.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/3232-0-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3232-1-0x000001F01FDD0000-0x000001F01FDD7000-memory.dmp

memory/3476-4-0x00000000024C0000-0x00000000024C1000-memory.dmp

memory/3232-7-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-9-0x00007FF8370DA000-0x00007FF8370DB000-memory.dmp

memory/3476-10-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-11-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-8-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-6-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-12-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-13-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-14-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-15-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-16-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-17-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-18-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-19-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-20-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-21-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-22-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-23-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-25-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-29-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-28-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-31-0x0000000000630000-0x0000000000637000-memory.dmp

memory/3476-30-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-27-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-26-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-38-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-39-0x00007FF8376A0000-0x00007FF8376B0000-memory.dmp

memory/3476-24-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-50-0x0000000140000000-0x0000000140161000-memory.dmp

memory/3476-48-0x0000000140000000-0x0000000140161000-memory.dmp

C:\Users\Admin\AppData\Local\VEZH\ReAgent.dll

MD5 3513c051f98d9109bbd8a243f2fe8c0f
SHA1 cf483272920b56b295ed5aea1224ed596a44fb90
SHA256 81b8a930f8c33e7a4c9b3d1b4cd5fd8ebbdb294870f265c539afac626e0ce6f1
SHA512 bfccdf72af9d1f5063d19b6fa849bee3c24ea56a82b5537209c6c6cacb89cc87dfe92143744989132bdfae18a4fdf75e6f70ed5a89754bc7f0f369a1f1a99a13

memory/2580-65-0x0000000140000000-0x0000000140162000-memory.dmp

memory/2580-60-0x000001A994120000-0x000001A994127000-memory.dmp

memory/2580-59-0x0000000140000000-0x0000000140162000-memory.dmp

C:\Users\Admin\AppData\Local\VEZH\recdisc.exe

MD5 611da32dad742e4f28ac58bf4cda9c09
SHA1 18c7e3287ed277d267df5a4a4f5ef2e41bdecece
SHA256 4fef20600aa9c688f71ea45af2407ca851e48b426cfdf23e53293cdedaaa0254
SHA512 2029424b3ce614ed0620e254fcde347f2c8ea16add0495823e5524964039c49e6564b96eb9440ed4038a2df287a5d02ff723a5c7c7632b4a3f319797d031c176

C:\Users\Admin\AppData\Local\VEZH\ReAgent.dll

MD5 4e1bf0ba058980590fce0c64c20a8d40
SHA1 173daa9b2df5a13ef7acfbf405f532d492354b02
SHA256 44ef5d0d584d79361ed87839278e6c76b748546290cd78aaaad081ee2bbbab18
SHA512 0a92a74809513777d13bfee2e8de8717e65a82f568542d0da8ca7196c3ca26ca32fd82b0284dbff903a002533ffdec3b0591b56cde4eec52fc23c944976ad912

C:\Users\Admin\AppData\Local\VEZH\recdisc.exe

MD5 0bde7bb724f7be2e7140985048a35bcc
SHA1 6f196223e4aa4594d9d5d96d8fbbb4e10036f7f7
SHA256 75b8c5c0928d6fcc63d01311a0a2a7377eef9aec597b4cbb80622d448ba8ca2e
SHA512 854a7579d4396e20e1ba1b1a152a2de35d192ddb0c6a0171a5109f74226b647884ea1678f327c17c82aa14c01f02bc7843aa30fded2e83d6c59f0f93cf8187e7

C:\Users\Admin\AppData\Local\X2Qak6OY\WTSAPI32.dll

MD5 ed3bd39ab46f45ca242fc32164a5aa6a
SHA1 da3d64b0353787431712b0054240abb18fcb3594
SHA256 a3745fc0d102f4c2c833c0b471caa6085f253f9b8bc354c1f705642204f0b4b2
SHA512 0d332f0af8b1f23e4c4f1934f32b2aeef923be0f6f2752ff5a381fd7bc8ce6ed12e9a8156051aeb5b9c864e6a1e0813489672687c72c2038897f98ee01d6ea1e

memory/4860-76-0x0000025C36A70000-0x0000025C36A77000-memory.dmp

memory/4860-82-0x0000000140000000-0x0000000140162000-memory.dmp

C:\Users\Admin\AppData\Local\X2Qak6OY\WTSAPI32.dll

MD5 71b724b557b4b96f5599f613fcccf84f
SHA1 9dd8febad37994522216b4fe247a8a67858522ce
SHA256 05000e12842042d918f3321172f82cbbb0e7fbeef632cc22f4fa5916378f68fd
SHA512 dc93b10351770e1cb165c08031fe098a741ce4fa46d242b5ddd0fa97d33cd9ada545ade8e9de2647dbb9b87f8d4c3b5c954f63df03dd9efac21ba3e64eff43f6

C:\Users\Admin\AppData\Local\X2Qak6OY\sethc.exe

MD5 1a5cc3878a15747c337be8831a93d4eb
SHA1 6bc014fcb5b8e8bd2a84fc7e452b326f6343ed80
SHA256 aad6236f9a8d2c1c3dd86bbf7af3a8d2361d4ca54e3fc1169dd35469148e96e3
SHA512 e9e87d428fe85a01b36ed86ec761a998cb51c26db354eaf38cc558c8986d1f91248de594594a1f3f3b792414e058690ebd0c4d6e5bf151aeb6f55db75f1766f2

C:\Users\Admin\AppData\Local\I2Dz\msinfo32.exe

MD5 764725107e75fd0687c5f2a9a0416b76
SHA1 a1bbcb94b8d8becdb6fd78f2313aab5c0e2f3085
SHA256 cd690d3ed9d48eff49230622cc153d5fbea8fe8c00a7dbcc53da33254f350104
SHA512 2c4bf169a17d45564c027c910a53f20b3a63e4be0af727d27021acb08d83f21606250ebf33bc6950408392e91fcfa7c85091681162ea831759a82da0db79f95a

memory/2004-93-0x0000000140000000-0x0000000140168000-memory.dmp

memory/2004-99-0x0000000140000000-0x0000000140168000-memory.dmp

C:\Users\Admin\AppData\Local\I2Dz\msinfo32.exe

MD5 584b0df4d6ad1546d6b990a377d1e048
SHA1 4d3119e628065bf37103655e977c868d343c1e5c
SHA256 dea55b1a07a79d2df4bb8074706789357326966f955336b4b7119c41fe3846ed
SHA512 45aa410a060be6f27442778b3d9a3d49470c10cde1ce2a601a84227f35dd31f8d5bd8a7046360b0ff395d0e8875d312ea12ec05b41d8159b0309d0885b376ddf

memory/2004-96-0x000001D1D58A0000-0x000001D1D58A7000-memory.dmp

C:\Users\Admin\AppData\Local\I2Dz\MFC42u.dll

MD5 0cded48c0ca9544f35b337d8aacbba6e
SHA1 e563ad20c2a467ee4b227d27037a5771dd6a4e3f
SHA256 ef80059892d4aebfb5ad4b8880514266980c9b1e9c9211af2380942780e31eba
SHA512 6df5fea08e650b63d200288682baa984e61614e1927f580147ad3be3cf791c5e384d379a35088de19b5f2c9abbc2ab214f963257f58597ff5623b20e269a75d2

C:\Users\Admin\AppData\Local\I2Dz\MFC42u.dll

MD5 8704032198d36bbd6a626c374712533b
SHA1 5aea8fa32867c0dee0a74ff256fbe8a0424a8af8
SHA256 3e941883686ee00d69be27206f5a9ad6ff5e58950002b651c043018ce91933c4
SHA512 a055f5e49b9848d39373509bc413f9c4c95d713bb98736af64a8e5071b5ab6923cf96a21eb70eeb9680380fca999e6cbe11469c7534a173a1ed25dc5af6fc2d3

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Aqwbkkvq.lnk

MD5 4dbe7fbb3e04c9012425293345b42e9b
SHA1 5150da6a1a45886c38fe1402a43ed54e3f484f84
SHA256 f75d3bffb69f907fa718f1e76c3a5017b7250d23fe7711cba9fdf1a58bdd5595
SHA512 03da3396e9aa6c4801ea5f8063367bd1bae3e78ad2d3cd2f107374ee6197866b0da1a1d658bc7f717b827b65db5c43a3ac37438da8800d964b6a86d96ac5e7fe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\WbNMT\ReAgent.dll

MD5 b0cdad346787aa9642de4d2a344711d2
SHA1 a320dfaf03772a72a468bba13a18256303dffb29
SHA256 2d99817eb94d9dca78ddcae85e12f9decdf6e563700636c5af1f39855c61bd98
SHA512 0b83723f785c78e554807b80c245d59b5c082a36f39a2f264c025d21a0391db457265757ff7f18383bb64c16e4dac17b5e2efb0a415dc08e0a287544cb713adc