Malware Analysis Report

2024-11-30 21:47

Sample ID 231231-cnkdhsdbdl
Target 2419b291711b308d6179fc8b0f354260
SHA256 b01ea30dce81bda2d39cd626a731e698910e9e51576dce55487d5df791fe8f94
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b01ea30dce81bda2d39cd626a731e698910e9e51576dce55487d5df791fe8f94

Threat Level: Known bad

The file 2419b291711b308d6179fc8b0f354260 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Dridex payload

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-31 02:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-31 02:13

Reported

2024-01-01 22:11

Platform

win7-20231215-en

Max time kernel

149s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2419b291711b308d6179fc8b0f354260.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\EdYM36\mstsc.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\ByiWO\tcmsetup.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\GNhS\Utilman.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rtxtioiynm = "C:\\Users\\Admin\\AppData\\Roaming\\MACROM~1\\FLASHP~1\\MACROM~1.COM\\support\\FLASHP~1\\sys\\11EUMZ~1\\tcmsetup.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\EdYM36\mstsc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\ByiWO\tcmsetup.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\GNhS\Utilman.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\EdYM36\mstsc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\EdYM36\mstsc.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1208 wrote to memory of 2284 N/A N/A C:\Windows\system32\mstsc.exe
PID 1208 wrote to memory of 2284 N/A N/A C:\Windows\system32\mstsc.exe
PID 1208 wrote to memory of 2284 N/A N/A C:\Windows\system32\mstsc.exe
PID 1208 wrote to memory of 3012 N/A N/A C:\Users\Admin\AppData\Local\EdYM36\mstsc.exe
PID 1208 wrote to memory of 3012 N/A N/A C:\Users\Admin\AppData\Local\EdYM36\mstsc.exe
PID 1208 wrote to memory of 3012 N/A N/A C:\Users\Admin\AppData\Local\EdYM36\mstsc.exe
PID 1208 wrote to memory of 2652 N/A N/A C:\Windows\system32\tcmsetup.exe
PID 1208 wrote to memory of 2652 N/A N/A C:\Windows\system32\tcmsetup.exe
PID 1208 wrote to memory of 2652 N/A N/A C:\Windows\system32\tcmsetup.exe
PID 1208 wrote to memory of 2132 N/A N/A C:\Users\Admin\AppData\Local\ByiWO\tcmsetup.exe
PID 1208 wrote to memory of 2132 N/A N/A C:\Users\Admin\AppData\Local\ByiWO\tcmsetup.exe
PID 1208 wrote to memory of 2132 N/A N/A C:\Users\Admin\AppData\Local\ByiWO\tcmsetup.exe
PID 1208 wrote to memory of 2568 N/A N/A C:\Windows\system32\Utilman.exe
PID 1208 wrote to memory of 2568 N/A N/A C:\Windows\system32\Utilman.exe
PID 1208 wrote to memory of 2568 N/A N/A C:\Windows\system32\Utilman.exe
PID 1208 wrote to memory of 1756 N/A N/A C:\Users\Admin\AppData\Local\GNhS\Utilman.exe
PID 1208 wrote to memory of 1756 N/A N/A C:\Users\Admin\AppData\Local\GNhS\Utilman.exe
PID 1208 wrote to memory of 1756 N/A N/A C:\Users\Admin\AppData\Local\GNhS\Utilman.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2419b291711b308d6179fc8b0f354260.dll,#1

C:\Windows\system32\mstsc.exe

C:\Windows\system32\mstsc.exe

C:\Users\Admin\AppData\Local\EdYM36\mstsc.exe

C:\Users\Admin\AppData\Local\EdYM36\mstsc.exe

C:\Users\Admin\AppData\Local\ByiWO\tcmsetup.exe

C:\Users\Admin\AppData\Local\ByiWO\tcmsetup.exe

C:\Windows\system32\tcmsetup.exe

C:\Windows\system32\tcmsetup.exe

C:\Windows\system32\Utilman.exe

C:\Windows\system32\Utilman.exe

C:\Users\Admin\AppData\Local\GNhS\Utilman.exe

C:\Users\Admin\AppData\Local\GNhS\Utilman.exe

Network

N/A

Files

memory/1416-0-0x000007FEF6670000-0x000007FEF67B9000-memory.dmp

memory/1416-1-0x00000000000A0000-0x00000000000A7000-memory.dmp

memory/1208-3-0x0000000077976000-0x0000000077977000-memory.dmp

memory/1208-4-0x0000000002D40000-0x0000000002D41000-memory.dmp

memory/1208-11-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-18-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-20-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-28-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-27-0x0000000002D50000-0x0000000002D57000-memory.dmp

memory/1208-30-0x0000000077C10000-0x0000000077C12000-memory.dmp

memory/1208-29-0x0000000077BE0000-0x0000000077BE2000-memory.dmp

memory/1208-19-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-17-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-16-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-15-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-14-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-13-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-12-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-10-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-9-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-8-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-7-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-6-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-41-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1208-39-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1416-42-0x000007FEF6670000-0x000007FEF67B9000-memory.dmp

\Users\Admin\AppData\Local\EdYM36\mstsc.exe

MD5 a7a2756aaebaed2faf4b85149fb581a5
SHA1 97994eba15460b5d4cf7328e001ad2b84b8c9e7e
SHA256 196e47929bb3b27d86cbb813231d1e5fd801fcf04523c060b720f9def679e60c
SHA512 dc2984d4de5a7698e1bfaad656826c353773644a5780a14a3dfa98e8d3964fad23361f74221d2a515590052e3facf27a803d40f7727965d8a0bf33a53d5053a3

C:\Users\Admin\AppData\Local\EdYM36\Secur32.dll

MD5 cc99a9f5181b8bea8d6808d29f932dd4
SHA1 fc3f624e627a3da1a3e01ed3c36835ee4fa0da4d
SHA256 0441f0438da0d020a29df862426409b68f8f18ef3a6a19cc6c09f1f74859665b
SHA512 40c103323d44a0859ea033e5ff3987000e4da0a38a9d74e6e1be9535d88f0edb280e17a0f74b37c9b1bedf360cded5237f59bdd81fb033e852cb9702ca63dff0

\Users\Admin\AppData\Local\EdYM36\Secur32.dll

MD5 8337f04fdf2e2aee7c483a06853d7d34
SHA1 09072c5550f47a957327d7da4cd34133b9ba911d
SHA256 5b106495e780fffa75496b8d685f4175224f7cb4c55495e5285dd2e81373cdd0
SHA512 8fb05ff88318a132cba1e89fdbacc77a8138073f932a48608a5a8613d8587bb16dd125627242e104b7a3e6fa9ec3e3c6147caeefd1aad3133ceda229f2be163b

memory/3012-58-0x0000000002170000-0x0000000002177000-memory.dmp

memory/3012-61-0x000007FEF6670000-0x000007FEF67BA000-memory.dmp

C:\Users\Admin\AppData\Local\EdYM36\mstsc.exe

MD5 419c47a5a1e1be1f6ce47714da871784
SHA1 a924761e6a83a80fffc520ed1e664c3ee74e32b6
SHA256 2d46a9d5a8e93b857379aa2c3ef4eaf0757e375d84cf77d3c6a2c47a3789196b
SHA512 23a1b349a492ccd393a5f7aba27feae4fd4610bc10edb357e2925ce6e0a61453168e0d4dbf598ddf8b2c266c02773c03f00f420a3292a5abf6dea558abe7b640

memory/3012-56-0x000007FEF6670000-0x000007FEF67BA000-memory.dmp

\Users\Admin\AppData\Local\ByiWO\TAPI32.dll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2132-79-0x000007FEF6540000-0x000007FEF668B000-memory.dmp

memory/2132-76-0x0000000000100000-0x0000000000107000-memory.dmp

memory/1208-75-0x0000000077976000-0x0000000077977000-memory.dmp

memory/2132-73-0x000007FEF6540000-0x000007FEF668B000-memory.dmp

C:\Users\Admin\AppData\Local\ByiWO\TAPI32.dll

MD5 6d96c46416ae74b706eef86a69836236
SHA1 2dbb3f1e33890169300aa1a4fa45cd3ef06a102c
SHA256 1870b40ebed83141819058850dec258c3712b0cb0f23024b975317281706b600
SHA512 03ef8ba3fd5978a47484e6f821ee480f27ceae5ed0758bfed73832a5cfed344e9c665db8a1d64544a31999f4ca0145f885ab9c81ff3fe97ef30a38cb6fedac69

C:\Users\Admin\AppData\Local\ByiWO\tcmsetup.exe

MD5 0b08315da0da7f9f472fbab510bfe7b8
SHA1 33ba48fd980216becc532466a5ff8476bec0b31c
SHA256 e19556bb7aa39bbd5f0d568a95aec0b3af18dda438cc5737f945243b24d106e7
SHA512 c30501546efe2b0c003ef87ac381e901c69ddfc6791c6a5102cff3a07f56555d94995a4413b93036821aa214fc31501fa87eb519e1890ef75b2ec497983ffd58

memory/1756-94-0x000007FEF6510000-0x000007FEF668D000-memory.dmp

memory/1756-91-0x000007FEF6510000-0x000007FEF668D000-memory.dmp

C:\Users\Admin\AppData\Local\GNhS\DUI70.dll

MD5 67e3bbd44d581e947dafcacca22e6e6b
SHA1 26ac0dd4c6fedfe832b23da1d8b9d029240067c8
SHA256 f52cd3cb8c12b93dc665b960e6077973b858eda8fb7116c6e7f98d0f9c903e9f
SHA512 cf4ee889173ca72eab634ab7a33c56830c73d5231372114b1e4f7ad0be57cb0d61af2f7c891ce6bc27d784457fd3f8ccd57fec7a6a4d3fc53f1bff6c426298bc

C:\Users\Admin\AppData\Local\GNhS\Utilman.exe

MD5 f8a7a1640c630f5d2d8bbc9dda15993b
SHA1 694e1a13ea739dbe7432e3f2f3efa6bd7ad964e0
SHA256 a8b026dd5cbdbfc13a67eee147302f45e34caafff6fabb6682b323e00f553b4b
SHA512 6a45073e51cd14b5eb3b082b6c96110f5a2a56fd1b23ba1f310bfdad416804fdd46e8e60f447675ddefae53fbcf06203d50d917dede4f66062f8ca7b52597efb

\Users\Admin\AppData\Local\GNhS\Utilman.exe

MD5 46d7478395e708d74c64506c871c63c9
SHA1 3f048337bfa46c5f9339b64f67abbd015fd860b3
SHA256 741e81230aeeb271eb9d10740c7175af45305c40c1eec2a43d5f06547136897e
SHA512 d4b647b2dc7ab30449e677b26b477faf35a4a7c6fc5b95bc5cd96525116f24817be5cdd722111088d135c14900aa49716e75f945013ddf6c6eb4f144bf8031dc

C:\Users\Admin\AppData\Local\GNhS\Utilman.exe

MD5 32c5ee55eadfc071e57851e26ac98477
SHA1 8f8d0aee344e152424143da49ce2c7badabb8f9d
SHA256 7ca90616e68bc851f14658a366d80f21ddb7a7dd8a866049e54651158784a9ea
SHA512 e0943efa81f3087c84a5909c72a436671ee8cc3cc80154901430e83ec7966aac800ad4b26f4a174a0071da617c0982ceda584686c6e2056e1a83e864aca6c975

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Tiizeasb.lnk

MD5 ce058bf8f9f556a0c92b18cdd33dfe7d
SHA1 09085eff674a555451d847be125ea3553203c09c
SHA256 bc23096bf124002df34d1fd16261d13eff22acdf13aa492a3726a8a9bfb853ce
SHA512 6dd5440cb40987e949cb77f546dfb0c9ecd9a8e482673c19a6521abddb17dc438b84a02d42638a0f4ef78b8e018b645a3b2bc6eb11594e26ead777792ca0a1bf

C:\Users\Admin\AppData\Roaming\Adobe\8nMSun4\Secur32.dll

MD5 78cd435c2bb78c951eb88ade80c5c5fe
SHA1 c3c5629d2b6dad9a6e91b917829b3815ec8eaa7a
SHA256 2cb40d63d23cb6e223f8b6bc7562e3e24f3681110670ff7e27eb82f22031e616
SHA512 ac4221b69e7ffa70660d891af300cfeba463c1cd3f3581529f9b6c94c88d9e547a7df2f2c21e499a3034044d76452da42f7bbc041c9787629f75f7c8b1a97689

C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\11eUMZM6Qd\TAPI32.dll

MD5 f84b2da4a842d7b705d104df3ff1dfac
SHA1 bab36606ed69758eb3dc898583529bb0f6d3b46f
SHA256 525e592cad025c414c14cee1bcbaeb3a3be1cd42390fc21ce7ef34e028824a40
SHA512 c91d9c63d5e95a1f2413a7236fc1c70a6d406c9b498740eb0d0fd25d1a568a17bef6bffd1ef724e2a553ebfc6f330fbbeda92ae837191e2d6967154ba957a7e7

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\7OKC9pR8d\DUI70.dll

MD5 18fe877565482627cb5fe6fe8b5f5440
SHA1 8e7e8926e6e88075fdf115b72bf63e47ac93c258
SHA256 e1d0c9ec091309e43c83ca07653cf608a2b60ea3f195f6692a13f1f70faf4459
SHA512 11688819210d0eaa084f11d7f393d922cac9b86f803259ebd8d77db4ddaaa5e37b5deeb8324f2ac995241a17b1aaab51d4b287ae6f79885f71a6a49c5ec79e1d

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-31 02:13

Reported

2024-01-01 22:10

Platform

win10v2004-20231215-en

Max time kernel

149s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2419b291711b308d6179fc8b0f354260.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kqgfxymewp = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\PZ4FjT\\sethc.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\MdO\sethc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\fsHcsV\InfDefaultInstall.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\gP0\RecoveryDrive.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3560 wrote to memory of 1648 N/A N/A C:\Windows\system32\RecoveryDrive.exe
PID 3560 wrote to memory of 1648 N/A N/A C:\Windows\system32\RecoveryDrive.exe
PID 3560 wrote to memory of 4108 N/A N/A C:\Users\Admin\AppData\Local\gP0\RecoveryDrive.exe
PID 3560 wrote to memory of 4108 N/A N/A C:\Users\Admin\AppData\Local\gP0\RecoveryDrive.exe
PID 3560 wrote to memory of 2008 N/A N/A C:\Windows\system32\sethc.exe
PID 3560 wrote to memory of 2008 N/A N/A C:\Windows\system32\sethc.exe
PID 3560 wrote to memory of 1624 N/A N/A C:\Users\Admin\AppData\Local\MdO\sethc.exe
PID 3560 wrote to memory of 1624 N/A N/A C:\Users\Admin\AppData\Local\MdO\sethc.exe
PID 3560 wrote to memory of 4064 N/A N/A C:\Windows\system32\InfDefaultInstall.exe
PID 3560 wrote to memory of 4064 N/A N/A C:\Windows\system32\InfDefaultInstall.exe
PID 3560 wrote to memory of 4784 N/A N/A C:\Users\Admin\AppData\Local\fsHcsV\InfDefaultInstall.exe
PID 3560 wrote to memory of 4784 N/A N/A C:\Users\Admin\AppData\Local\fsHcsV\InfDefaultInstall.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2419b291711b308d6179fc8b0f354260.dll,#1

C:\Windows\system32\RecoveryDrive.exe

C:\Windows\system32\RecoveryDrive.exe

C:\Users\Admin\AppData\Local\gP0\RecoveryDrive.exe

C:\Users\Admin\AppData\Local\gP0\RecoveryDrive.exe

C:\Windows\system32\sethc.exe

C:\Windows\system32\sethc.exe

C:\Users\Admin\AppData\Local\MdO\sethc.exe

C:\Users\Admin\AppData\Local\MdO\sethc.exe

C:\Windows\system32\InfDefaultInstall.exe

C:\Windows\system32\InfDefaultInstall.exe

C:\Users\Admin\AppData\Local\fsHcsV\InfDefaultInstall.exe

C:\Users\Admin\AppData\Local\fsHcsV\InfDefaultInstall.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 147.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 179.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 11.2.37.23.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/1268-0-0x00007FFCBF9A0000-0x00007FFCBFAE9000-memory.dmp

memory/1268-1-0x00000249F9B10000-0x00000249F9B17000-memory.dmp

memory/3560-3-0x0000000002640000-0x0000000002641000-memory.dmp

memory/3560-6-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-5-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-7-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-9-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-10-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-17-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-21-0x0000000002600000-0x0000000002607000-memory.dmp

memory/3560-20-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-30-0x00007FFCCE110000-0x00007FFCCE120000-memory.dmp

memory/3560-29-0x00007FFCCE120000-0x00007FFCCE130000-memory.dmp

memory/3560-28-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-19-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-39-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-18-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-16-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-15-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-14-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-13-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-12-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-11-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3560-8-0x00007FFCCDECA000-0x00007FFCCDECB000-memory.dmp

memory/1268-42-0x00007FFCBF9A0000-0x00007FFCBFAE9000-memory.dmp

C:\Users\Admin\AppData\Local\gP0\RecoveryDrive.exe

MD5 b9b3dc6f2eb89e41ff27400952602c74
SHA1 24ae07e0db3ace0809d08bbd039db3a9d533e81b
SHA256 630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4
SHA512 7906954b881f1051a0c7f098e096bc28eddcc48643b8bf3134dd57b8c18d8beba4f9a0ac5d348de2f9b8ea607c3e9cb0e61d91e4f3ba1fefb02839f928e3e3fe

memory/4108-49-0x000001C46ED40000-0x000001C46ED47000-memory.dmp

memory/4108-54-0x00007FFCB0330000-0x00007FFCB047A000-memory.dmp

memory/4108-50-0x00007FFCB0330000-0x00007FFCB047A000-memory.dmp

C:\Users\Admin\AppData\Local\gP0\UxTheme.dll

MD5 c71ca2cb0cd6f545f8b352227f5639ff
SHA1 3fb9beb232ed7c785e4df991ebd1567b22a92639
SHA256 a1652b98688fa80f5850a35b077eb468aae325a0dd382b0a801d3041b4c36e70
SHA512 b6c0c462f8ba4411d3ecb43d989d6eb03203c30345a30c5efb8e3cfb1c5a258756a93c3038286a23397f9ee54162a13770db1a733e5336e769b81448846432ea

C:\Users\Admin\AppData\Local\MdO\WTSAPI32.dll

MD5 c1149d0d1cd46a9b3eb35371b41c4a63
SHA1 9001ee8245fd45cfdf537afc41cdf6338fe66928
SHA256 e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8
SHA512 448fb9b0e378ce4c33fc691343e6b0e1aba4f12b17f0e960d3a575ec9ac3a9d59e9972072d222c3f615433fb58cadfad85f7433a6abf43042fd53e36f18f6dba

C:\Users\Admin\AppData\Local\MdO\sethc.exe

MD5 8ba3a9702a3f1799431cad6a290223a6
SHA1 9c7dc9b6830297c8f759d1f46c8b36664e26c031
SHA256 615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8
SHA512 680c216d54f4fd2a14f0398e4461c8340ac15acdca75c36a42083625e1081d5e7d262c4c12296b6f21ba2f593f92816edf1c9a0cf4cbee23588e590713b87746

memory/1624-65-0x00007FFCB0450000-0x00007FFCB059A000-memory.dmp

memory/1624-70-0x00007FFCB0450000-0x00007FFCB059A000-memory.dmp

memory/1624-67-0x00000224A8CE0000-0x00000224A8CE7000-memory.dmp

C:\Users\Admin\AppData\Local\fsHcsV\InfDefaultInstall.exe

MD5 ee18876c1e5de583de7547075975120e
SHA1 f7fcb3d77da74deee25de9296a7c7335916504e3
SHA256 e59127b5fe82714956c7a1f10392a8673086a8e1f609e059935c7da1fa015a5d
SHA512 08bc4d28b8f528582c58175a74871dd33ac97955c3709c991779fc34b5ba4b2ba6ff40476d9f59345b61b0153fd932b0ea539431a67ff5012cb2ac8ab392f73c

C:\Users\Admin\AppData\Local\fsHcsV\newdev.dll

MD5 85d128f07ff90312f5fb731e6d78bc14
SHA1 fa90babf1c1b0156fe174d2cbef5ea7cf0aea02f
SHA256 065bd7f4c17efb7663861b149f752102b65468c3fd012307ab80dee5d5eae543
SHA512 d0b6846b9a983f553942d6b9278af5e6a4c4beeb4d0bea4b28aa8d3f10282d6072391ae9f7848f536dc62e2cc38113ff6376fd2994f0bb535b5821cb51647f3d

memory/4784-81-0x00007FFCBF7C0000-0x00007FFCBF90A000-memory.dmp

memory/4784-83-0x000001E1D1640000-0x000001E1D1647000-memory.dmp

memory/4784-86-0x00007FFCBF7C0000-0x00007FFCBF90A000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Psfjn.lnk

MD5 578a687da7077459eee2d77acb43c902
SHA1 9b6ee564e85d06ff69ccb40ec52e8e271cea9361
SHA256 6fcc383bba5ef92cf488c5e4a68aff1150f43f44e2e3e6fb0dc96a42bf29cd71
SHA512 6df5322e4755047303bd32634bb962dd486f1b6c25f417791f7a8e8889111e8c2200aecc5559fea20ec32fb34bbcd2c5da702653394d41145b62df5649fd549d