Malware Analysis Report

2024-11-30 21:30

Sample ID 240101-ss54safga5
Target 3d349d0f5f081d9968e781ca25ae35ee
SHA256 f6f7330ed919acdb74a09711842bf8efe9d295dd4d1c36da4ae39b06a5c3b5af
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f6f7330ed919acdb74a09711842bf8efe9d295dd4d1c36da4ae39b06a5c3b5af

Threat Level: Known bad

The file 3d349d0f5f081d9968e781ca25ae35ee was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex payload

Dridex Shellcode

Loads dropped DLL

Executes dropped EXE

Checks whether UAC is enabled

Adds Run key to start application

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-01 15:24

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-01 15:24

Reported

2024-01-01 15:27

Platform

win7-20231215-en

Max time kernel

152s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d349d0f5f081d9968e781ca25ae35ee.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\w37Q08r\raserver.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\eF2x\Dxpserver.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\paLPh\mmc.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lgpbj = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\QUICKL~1\\USERPI~1\\TaskBar\\RY0nz\\DXPSER~1.EXE" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\paLPh\mmc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\w37Q08r\raserver.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\eF2x\Dxpserver.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1244 wrote to memory of 2060 N/A N/A C:\Windows\system32\raserver.exe
PID 1244 wrote to memory of 2060 N/A N/A C:\Windows\system32\raserver.exe
PID 1244 wrote to memory of 2060 N/A N/A C:\Windows\system32\raserver.exe
PID 1244 wrote to memory of 3024 N/A N/A C:\Users\Admin\AppData\Local\w37Q08r\raserver.exe
PID 1244 wrote to memory of 3024 N/A N/A C:\Users\Admin\AppData\Local\w37Q08r\raserver.exe
PID 1244 wrote to memory of 3024 N/A N/A C:\Users\Admin\AppData\Local\w37Q08r\raserver.exe
PID 1244 wrote to memory of 1776 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 1244 wrote to memory of 1776 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 1244 wrote to memory of 1776 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 1244 wrote to memory of 2524 N/A N/A C:\Users\Admin\AppData\Local\eF2x\Dxpserver.exe
PID 1244 wrote to memory of 2524 N/A N/A C:\Users\Admin\AppData\Local\eF2x\Dxpserver.exe
PID 1244 wrote to memory of 2524 N/A N/A C:\Users\Admin\AppData\Local\eF2x\Dxpserver.exe
PID 1244 wrote to memory of 2028 N/A N/A C:\Windows\system32\mmc.exe
PID 1244 wrote to memory of 2028 N/A N/A C:\Windows\system32\mmc.exe
PID 1244 wrote to memory of 2028 N/A N/A C:\Windows\system32\mmc.exe
PID 1244 wrote to memory of 268 N/A N/A C:\Users\Admin\AppData\Local\paLPh\mmc.exe
PID 1244 wrote to memory of 268 N/A N/A C:\Users\Admin\AppData\Local\paLPh\mmc.exe
PID 1244 wrote to memory of 268 N/A N/A C:\Users\Admin\AppData\Local\paLPh\mmc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d349d0f5f081d9968e781ca25ae35ee.dll,#1

C:\Windows\system32\raserver.exe

C:\Windows\system32\raserver.exe

C:\Users\Admin\AppData\Local\w37Q08r\raserver.exe

C:\Users\Admin\AppData\Local\w37Q08r\raserver.exe

C:\Windows\system32\Dxpserver.exe

C:\Windows\system32\Dxpserver.exe

C:\Users\Admin\AppData\Local\eF2x\Dxpserver.exe

C:\Users\Admin\AppData\Local\eF2x\Dxpserver.exe

C:\Windows\system32\mmc.exe

C:\Windows\system32\mmc.exe

C:\Users\Admin\AppData\Local\paLPh\mmc.exe

C:\Users\Admin\AppData\Local\paLPh\mmc.exe

Network

N/A

Files

memory/2992-0-0x000007FEF7240000-0x000007FEF7317000-memory.dmp

memory/2992-1-0x0000000000190000-0x0000000000197000-memory.dmp

memory/1244-3-0x0000000077AA6000-0x0000000077AA7000-memory.dmp

memory/1244-4-0x0000000002970000-0x0000000002971000-memory.dmp

memory/1244-6-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-9-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-13-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-15-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-19-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-18-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-17-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-16-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-14-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-12-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-11-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-10-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-8-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-7-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-20-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-22-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-21-0x0000000002950000-0x0000000002957000-memory.dmp

memory/1244-31-0x0000000077D40000-0x0000000077D42000-memory.dmp

memory/1244-30-0x0000000077D10000-0x0000000077D12000-memory.dmp

memory/1244-29-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-41-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/1244-40-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/2992-49-0x000007FEF7240000-0x000007FEF7317000-memory.dmp

\Users\Admin\AppData\Local\w37Q08r\raserver.exe

MD5 51cab810a0a55fd86b0b9e52143b2b13
SHA1 afc29e6ff643ff5f5eb859b64102421ca904ba3f
SHA256 6180ae37380453ffa272739ba59c35523284f4ab9d5238727dec78126fedab4a
SHA512 b2e8736524a32c280a9b4a791f4137fe1b5233d4ed9be8fefa25d578318a943030af181baf8396f3bad9a41d24e4bdf46d44acc7f613e6029d50fb6b15b25c0d

C:\Users\Admin\AppData\Local\w37Q08r\raserver.exe

MD5 b0955337cb29c1a89b4af183f5078c13
SHA1 d1962b062fe19e175a2b4076147cd61df17013fd
SHA256 14162557c7c9aae72431fd3368597c6ceb211ea61f6d09204ece7f7a772239a1
SHA512 23eeaa789829662c1cd49ff48a9b9361980e62ad7b4352956a862c27ce11069fd33e33ad424fbc47eb4e6704f7f2957066e43d7642459986247c1cae5856b095

C:\Users\Admin\AppData\Local\w37Q08r\WTSAPI32.dll

MD5 0fb70b85823157a58414634a7fe3579a
SHA1 72503f03abf76c5d8b0431e15e33b5d0aa0f5129
SHA256 6b9b3b605040abf5cb87e5d16c59ec243c5d7f444b057ce3edd1f2da4638c1c5
SHA512 e3b80273e3e79c197be42cd2ff0867fa26198edb4f9016d413f813d6c41a3e488bfb19e824adc6b817e090f39ed320e1d4c54e819066f3214fa8fbf11bcc62ea

\Users\Admin\AppData\Local\w37Q08r\WTSAPI32.dll

MD5 1096d868497b1522f23460bfebc6fcef
SHA1 dd0894737dee4eabd7e2449abc37c47d8cba804b
SHA256 cfff3cec50b4d597fbb8f790d9e6dcecc6c051a19f2a849847d06e8cd0dad29e
SHA512 4e7abc1aa2be027dc66e0b127c949b401779c6460daba5d163d316ee0f8556e688dab2ff655186f6cf3d9b6816040159c219a0c1a9ecfd2ff7a90d478bb63635

memory/1244-59-0x0000000077AA6000-0x0000000077AA7000-memory.dmp

memory/3024-57-0x000007FEF7320000-0x000007FEF73F8000-memory.dmp

memory/3024-60-0x00000000000E0000-0x00000000000E7000-memory.dmp

memory/3024-63-0x000007FEF7320000-0x000007FEF73F8000-memory.dmp

C:\Users\Admin\AppData\Local\w37Q08r\raserver.exe

MD5 cd0bc0b6b8d219808aea3ecd4e889b19
SHA1 9f8f4071ce2484008e36fdfd963378f4ebad703f
SHA256 16abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA512 84291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac

\Users\Admin\AppData\Local\eF2x\dwmapi.dll

MD5 ed41a7acd1570c0cb209fb78a510913c
SHA1 30fda436b738c41241361400041907614430175f
SHA256 671c1d30033360c181ec050b7c01bf24d6a5d00e143d77ce5ae4169d49504418
SHA512 c7df107910b5d1c8b9dd6ad642ddb9cf2e0c6e871f2a87f59fbf2ff564dfbbfe2dc734c70c5de01615c0383e9ea2aba9944abcdf8c5735ae56f20237eaf1ada4

memory/2524-75-0x000007FEF6C90000-0x000007FEF6D68000-memory.dmp

C:\Users\Admin\AppData\Local\eF2x\dwmapi.dll

MD5 c894290978c3bde7df52f3bdf07aa54c
SHA1 344dc66e0dcda00dc426600267c0128edc2b4e5b
SHA256 64e2887ef37971a3017bae06b5d840f9a75f655a0524ad509c70b2ecec2cb67f
SHA512 fe026650a47a7ca124eb05cd6dfd663fd0bd75e365ed15a7b6d2a785e16a400eecf97d144aff3b5eb4a8557093bec1729ccfb6a47cd35b0baf50c0da7d247ee4

memory/2524-79-0x000007FEF6C90000-0x000007FEF6D68000-memory.dmp

C:\Users\Admin\AppData\Local\eF2x\Dxpserver.exe

MD5 4d38389fb92e43c77a524fd96dbafd21
SHA1 08014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256 070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA512 02d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba

C:\Users\Admin\AppData\Local\paLPh\UxTheme.dll

MD5 7297dbe4ec63b03351669338d046bdc6
SHA1 38358616383eadca6167d5b16c8f627ec1a189a4
SHA256 659873459d773c569ee559f5db405672b44d204fec0c5760073c6e67183c32f4
SHA512 a62813902885ed3bf6084cd5bbdbfdc2b6129626082e04bdd51cb464a5570f113728f535636f9bc6c3f867ef507f66c7ad6fbd23a032bd3022dcdb9810eb19e7

C:\Users\Admin\AppData\Local\paLPh\mmc.exe

MD5 20a52af2febd8c1413af7eda92d9267b
SHA1 287715c119e1aa85e4faecaca86c2280b3109f3d
SHA256 d4e244b4342cd8c0dce0463ea0e8846678ea8279bafd4d7f50e84e31bb31d28f
SHA512 b0c55f7a3abfa173ee7613ebfcebc9f7a8c23ecbef662e778383a66bb74f4292b1a9dcaaae03169ee39e045d3936aed4e2c06aa3ef41d0a0f29b309a8c9d9901

\Users\Admin\AppData\Local\paLPh\UxTheme.dll

MD5 a61795dc51486b2073dca3c4e742da84
SHA1 640d7513ad9e968a5b3269b86d839e9b13b722af
SHA256 2504355474dd5b68150152f04cfdaef43d6c0ddd2b91530e4566362b685b7f0b
SHA512 b932163110fb38003dd42ef28c0d3769aff331f671dee97305dad9406856c94962a0d3d3bc1464b2c61b18e6a2bcf6ddffbb17b9ed071c94befd7329ed11c74e

\Users\Admin\AppData\Local\paLPh\mmc.exe

MD5 013730d3f002cd470bd64beb195205d2
SHA1 334403c9f245616ac0bb6eebc6779cbdf2364bca
SHA256 eee516c5579f8d0902908689fee86ca13aa99cb66fad7bcdb60231c835d7a7db
SHA512 d0f6c482d979b274d498c92c0b4df5b0150c8487fd983dc27f96ce81944b1d5f3c69514899d754fee595c0281f62a1b9a8fa20c6abdc1cbc8d24cd5a024cdce7

memory/268-91-0x00000000001D0000-0x00000000001D7000-memory.dmp

memory/268-92-0x000007FEF66C0000-0x000007FEF6798000-memory.dmp

memory/268-95-0x000007FEF66C0000-0x000007FEF6798000-memory.dmp

C:\Users\Admin\AppData\Local\paLPh\mmc.exe

MD5 79e068dfa1243e240dd47f78cda8e895
SHA1 d514546bc6694d4b73f16de5052d8c2a9cf3a5f9
SHA256 7cf58a9174dc14d109f83b4ebff58109d0896f8e0463f5f95c085a5672f26f55
SHA512 0443414c50ea61db9fb12cfb10b9e11eaba881095aec3668658e41134b66e01da3a0cda630cc6e33a0e5c1d779fb5fdc7e885503a0f6ce801e48eaa266bf022c

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\YI\mmc.exe

MD5 0158616a3a728d2e7f2564ea0bc77e30
SHA1 9d59318b3205775864df5825aaa88c3de610ad31
SHA256 d5dd456b668a719047661e9c888b1b2aaaffd8180ce6bd93212c89e427b64a15
SHA512 4922d6fb8c97b6273fd0d0034e942c8a21c04c2b7429db4be6b552875e55c2d8d5d84aeead68498d750318636ef9b814096671458831fde8b0da6372ba9fc2a9

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yiudzqwx.lnk

MD5 8fe454d01ce22eb17fb2847928902952
SHA1 65d9e7871f1b92b61c345cfc53770be89d6e1765
SHA256 8d0199022d095b6b1594beeeafca19d447c79b4d4891171c83cf739428ca5276
SHA512 a5d10aa44bd54ec7a9ea05b1889a0fe9957b6f98449e0088c250fad95a52151e674d0025ad9160b431097a92093f046b6dd8ee2d438952be2f9d52d555ccc4b5

C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\zGyGZByWMo\WTSAPI32.dll

MD5 2bb31f5e1e85a09bbe19bf22931f6a17
SHA1 ccd91b16e5e11e39d736ed4b82b777db0e68056c
SHA256 ed46b7d05970889342f9e381b623ec7ae4588d940606c9796c1c5048de207632
SHA512 6ef2c28260c4a6d13330224146cfbb948be6beefeac4883787e997abf27537a49cc9660eb8fb7d888c927e5129a9acc3cabfe93413b07b655f994fa98045b7f2

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\RY0nz\dwmapi.dll

MD5 87cb3facd668e5e0d86775b63bab2991
SHA1 9beb1a87d797afc4d6c628b76b1b5ef98a9a586e
SHA256 826b6965012b5f86d9de0c11106c9ac9813ba5a51298abf16bfe7fb417e2a434
SHA512 574d0ec09c1a540378439d9f2ea6fe6ac67fd3777168132811ccdbc7d4d4de7e2cce1c1bcb7cdd764bba3abf71144579be1ff813d935e460e0473064e8ab9b71

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\YI\UxTheme.dll

MD5 35898bb09406e4551ce8cbdc2c36118e
SHA1 126cb09e7d34a44f87942e2e4046a9da07457f4b
SHA256 936ea2a9353cc7c35c1df8dff70209c18267b0e334cb1f69ffed5599e8dcd1de
SHA512 9b7c65c6b6a2fe6faf6e923f8f7446102d72d74b5cbd3b5c07221268fb0ea05a115c198bfe06fa54f5d58cf483bd1cdb6fefa7aed146f661aa79b85df74b0843

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-01 15:24

Reported

2024-01-01 15:27

Platform

win10v2004-20231215-en

Max time kernel

151s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d349d0f5f081d9968e781ca25ae35ee.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dturazvnnsjkgvr = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5bSclog\\DmNotificationBroker.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\3lFY\DmNotificationBroker.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Kw3\WMPDMC.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\oNMtHY6\PasswordOnWakeSettingFlyout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3580 wrote to memory of 4876 N/A N/A C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
PID 3580 wrote to memory of 4876 N/A N/A C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
PID 3580 wrote to memory of 696 N/A N/A C:\Users\Admin\AppData\Local\oNMtHY6\PasswordOnWakeSettingFlyout.exe
PID 3580 wrote to memory of 696 N/A N/A C:\Users\Admin\AppData\Local\oNMtHY6\PasswordOnWakeSettingFlyout.exe
PID 3580 wrote to memory of 4416 N/A N/A C:\Windows\system32\DmNotificationBroker.exe
PID 3580 wrote to memory of 4416 N/A N/A C:\Windows\system32\DmNotificationBroker.exe
PID 3580 wrote to memory of 5060 N/A N/A C:\Users\Admin\AppData\Local\3lFY\DmNotificationBroker.exe
PID 3580 wrote to memory of 5060 N/A N/A C:\Users\Admin\AppData\Local\3lFY\DmNotificationBroker.exe
PID 3580 wrote to memory of 4056 N/A N/A C:\Windows\system32\WMPDMC.exe
PID 3580 wrote to memory of 4056 N/A N/A C:\Windows\system32\WMPDMC.exe
PID 3580 wrote to memory of 3336 N/A N/A C:\Users\Admin\AppData\Local\Kw3\WMPDMC.exe
PID 3580 wrote to memory of 3336 N/A N/A C:\Users\Admin\AppData\Local\Kw3\WMPDMC.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d349d0f5f081d9968e781ca25ae35ee.dll,#1

C:\Windows\system32\PasswordOnWakeSettingFlyout.exe

C:\Windows\system32\PasswordOnWakeSettingFlyout.exe

C:\Users\Admin\AppData\Local\oNMtHY6\PasswordOnWakeSettingFlyout.exe

C:\Users\Admin\AppData\Local\oNMtHY6\PasswordOnWakeSettingFlyout.exe

C:\Windows\system32\DmNotificationBroker.exe

C:\Windows\system32\DmNotificationBroker.exe

C:\Users\Admin\AppData\Local\3lFY\DmNotificationBroker.exe

C:\Users\Admin\AppData\Local\3lFY\DmNotificationBroker.exe

C:\Windows\system32\WMPDMC.exe

C:\Windows\system32\WMPDMC.exe

C:\Users\Admin\AppData\Local\Kw3\WMPDMC.exe

C:\Users\Admin\AppData\Local\Kw3\WMPDMC.exe

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 21.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 205.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 2.17.5.133:80 www.microsoft.com tcp
US 8.8.8.8:53 133.5.17.2.in-addr.arpa udp
US 2.17.5.133:80 www.microsoft.com tcp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 206.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp

Files

memory/4408-1-0x000002F60E0C0000-0x000002F60E0C7000-memory.dmp

memory/4408-0-0x00007FFAF36B0000-0x00007FFAF3787000-memory.dmp

memory/3580-3-0x0000000002E50000-0x0000000002E51000-memory.dmp

memory/3580-5-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-7-0x00007FFB0006A000-0x00007FFB0006B000-memory.dmp

memory/3580-6-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-8-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-9-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-10-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-11-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-12-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-14-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-16-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-17-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-18-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-15-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-13-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-19-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-20-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-21-0x0000000001110000-0x0000000001117000-memory.dmp

memory/3580-22-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-30-0x00007FFB01C80000-0x00007FFB01C90000-memory.dmp

memory/3580-29-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/3580-31-0x00007FFB01C70000-0x00007FFB01C80000-memory.dmp

memory/3580-40-0x0000000140000000-0x00000001400D7000-memory.dmp

memory/4408-43-0x00007FFAF36B0000-0x00007FFAF3787000-memory.dmp

C:\Users\Admin\AppData\Local\oNMtHY6\PasswordOnWakeSettingFlyout.exe

MD5 591a98c65f624c52882c2b238d6cd4c4
SHA1 c960d08c19d777069cf265dcc281807fbd8502d7
SHA256 5e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06
SHA512 1999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074

C:\Users\Admin\AppData\Local\oNMtHY6\UxTheme.dll

MD5 6839c0418a1722b1b889f533190bbef9
SHA1 0667fe24b7e48e5914ba69d67b6916fc350fae00
SHA256 ec6c3d9867ab2c647db916977fcc631a54f44f2b40097d872b11ebf5496bae7b
SHA512 e53ca3cd1143dfda108862112e5ecf1d3a995327f7339e5a52327c19982bc192465173ac7b40292a2cdcb43db07c9f16188f8631ceaeb71b95da677f107b5087

memory/696-50-0x00007FFAE37D0000-0x00007FFAE38A8000-memory.dmp

memory/696-51-0x000002198EDA0000-0x000002198EDA7000-memory.dmp

memory/696-55-0x00007FFAE37D0000-0x00007FFAE38A8000-memory.dmp

C:\Users\Admin\AppData\Local\3lFY\DmNotificationBroker.exe

MD5 f0bdc20540d314a2aad951c7e2c88420
SHA1 4ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256 f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512 cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa

C:\Users\Admin\AppData\Local\3lFY\DUI70.dll

MD5 82052f92bffabaac988f1067ced2130c
SHA1 2c965abc87b34c49ff6109d5235024d4aeec1e08
SHA256 c93698df3c42e6793176180cf7c191130bdbfc390eedbcc0cbd0c48aec091afd
SHA512 94c8e1075bb6511c3b1dbe3f25abcdf4372b64d0ff65c40b845cbcbc8bcbcfec3f7b112ba60330a75cfaacd2276171ee4844cfcfd02926e723d43754e766bd4b

memory/5060-66-0x00007FFAE3940000-0x00007FFAE3A5D000-memory.dmp

memory/5060-68-0x0000020502A00000-0x0000020502A07000-memory.dmp

memory/5060-71-0x00007FFAE3940000-0x00007FFAE3A5D000-memory.dmp

C:\Users\Admin\AppData\Local\Kw3\WMPDMC.exe

MD5 59ce6e554da0a622febce19eb61c4d34
SHA1 176a4a410cb97b3d4361d2aea0edbf17e15d04c7
SHA256 c36eba7186f7367fe717595f3372a49503c9613893c2ab2eff38b625a50d04ba
SHA512 e9b0d310416b66e0055381391bb6b0c19ee26bbcf0e3bb9ea7d696d5851e6efbdd9bdeb250c74638b7d73b20528ea1dfb718e75ad5977aaad77aae36cc7b7e18

C:\Users\Admin\AppData\Local\Kw3\OLEACC.dll

MD5 dbb01488a7824f55bfed8fc5f29f0893
SHA1 40256e1cab203a3e60d573f9a33ebfdf9b56146c
SHA256 694a463f347d855c02605a634b7cb742d86d56340f2c610e7d3338decb2eda8b
SHA512 ff67467e005ba452c48553b80f5fef6b47076c667c979e73751d6c564040426343a897c4d5e7c8c01f6afcb6d22d3e3d17697537a2c3e795fe31dded156b8bfd

memory/3336-82-0x00007FFAF3190000-0x00007FFAF3268000-memory.dmp

memory/3336-83-0x0000016B0B7D0000-0x0000016B0B7D7000-memory.dmp

memory/3336-87-0x00007FFAF3190000-0x00007FFAF3268000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dvizybqqo.lnk

MD5 5fe49175f1d57c668a89ae86a7a101fb
SHA1 f1b4696db2b3be21acf17b5b3310d8d15f4851a6
SHA256 74262e3eeddd1303d0f109aeeb73789afbd7574a5a4b470a5acaf465c9091171
SHA512 9448a0ce1e2fef9c617bb99d11e49930b870fde78b3017a0fa0767e012b34d1e55bce1c5ed3676a441929bd39cb52dae8eaa5463f1fa4efa1d297b48012a5a79