Malware Analysis Report

2024-11-30 21:28

Sample ID 240106-mbrl6seff3
Target 3c668588dcb6a4b825f4486bdc405a86.exe
SHA256 81a37b8a90f46603b35c91a9b31908d4b8bff1d32559cdf2e3761a10079a8296
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

81a37b8a90f46603b35c91a9b31908d4b8bff1d32559cdf2e3761a10079a8296

Threat Level: Known bad

The file 3c668588dcb6a4b825f4486bdc405a86.exe was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-06 10:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-06 10:17

Reported

2024-01-06 10:23

Platform

win7-20231215-en

Max time kernel

245s

Max time network

282s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c668588dcb6a4b825f4486bdc405a86.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\zL4d9m\DWWIN.EXE N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\TGU2GL1F\Netplwiz.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\ZcRUKPq\SystemPropertiesPerformance.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xkgbzoakajt = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\ACCESS~1\\SYSTEM~1\\3ZhpInZb\\Netplwiz.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\ZcRUKPq\SystemPropertiesPerformance.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\zL4d9m\DWWIN.EXE N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\TGU2GL1F\Netplwiz.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1232 wrote to memory of 1080 N/A N/A C:\Windows\system32\DWWIN.EXE
PID 1232 wrote to memory of 1080 N/A N/A C:\Windows\system32\DWWIN.EXE
PID 1232 wrote to memory of 1080 N/A N/A C:\Windows\system32\DWWIN.EXE
PID 1232 wrote to memory of 2332 N/A N/A C:\Users\Admin\AppData\Local\zL4d9m\DWWIN.EXE
PID 1232 wrote to memory of 2332 N/A N/A C:\Users\Admin\AppData\Local\zL4d9m\DWWIN.EXE
PID 1232 wrote to memory of 2332 N/A N/A C:\Users\Admin\AppData\Local\zL4d9m\DWWIN.EXE
PID 1232 wrote to memory of 1412 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 1232 wrote to memory of 1412 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 1232 wrote to memory of 1412 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 1232 wrote to memory of 744 N/A N/A C:\Users\Admin\AppData\Local\TGU2GL1F\Netplwiz.exe
PID 1232 wrote to memory of 744 N/A N/A C:\Users\Admin\AppData\Local\TGU2GL1F\Netplwiz.exe
PID 1232 wrote to memory of 744 N/A N/A C:\Users\Admin\AppData\Local\TGU2GL1F\Netplwiz.exe
PID 1232 wrote to memory of 932 N/A N/A C:\Windows\system32\SystemPropertiesPerformance.exe
PID 1232 wrote to memory of 932 N/A N/A C:\Windows\system32\SystemPropertiesPerformance.exe
PID 1232 wrote to memory of 932 N/A N/A C:\Windows\system32\SystemPropertiesPerformance.exe
PID 1232 wrote to memory of 752 N/A N/A C:\Users\Admin\AppData\Local\ZcRUKPq\SystemPropertiesPerformance.exe
PID 1232 wrote to memory of 752 N/A N/A C:\Users\Admin\AppData\Local\ZcRUKPq\SystemPropertiesPerformance.exe
PID 1232 wrote to memory of 752 N/A N/A C:\Users\Admin\AppData\Local\ZcRUKPq\SystemPropertiesPerformance.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c668588dcb6a4b825f4486bdc405a86.dll,#1

C:\Windows\system32\DWWIN.EXE

C:\Windows\system32\DWWIN.EXE

C:\Users\Admin\AppData\Local\zL4d9m\DWWIN.EXE

C:\Users\Admin\AppData\Local\zL4d9m\DWWIN.EXE

C:\Windows\system32\Netplwiz.exe

C:\Windows\system32\Netplwiz.exe

C:\Users\Admin\AppData\Local\TGU2GL1F\Netplwiz.exe

C:\Users\Admin\AppData\Local\TGU2GL1F\Netplwiz.exe

C:\Windows\system32\SystemPropertiesPerformance.exe

C:\Windows\system32\SystemPropertiesPerformance.exe

C:\Users\Admin\AppData\Local\ZcRUKPq\SystemPropertiesPerformance.exe

C:\Users\Admin\AppData\Local\ZcRUKPq\SystemPropertiesPerformance.exe

Network

N/A

Files

memory/2908-0-0x0000000140000000-0x000000014016D000-memory.dmp

memory/2908-1-0x0000000000110000-0x0000000000117000-memory.dmp

memory/1232-4-0x00000000771D6000-0x00000000771D7000-memory.dmp

memory/1232-5-0x00000000025A0000-0x00000000025A1000-memory.dmp

memory/1232-7-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-12-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-18-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-19-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-20-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-17-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-21-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-23-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-27-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-29-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-32-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-37-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-38-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-39-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-40-0x0000000002580000-0x0000000002587000-memory.dmp

memory/1232-35-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-36-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-49-0x0000000077540000-0x0000000077542000-memory.dmp

memory/1232-48-0x00000000773E1000-0x00000000773E2000-memory.dmp

memory/1232-47-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-34-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-33-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-31-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-30-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-28-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-26-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-25-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-24-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-22-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-16-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-15-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-14-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-13-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-11-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-10-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-9-0x0000000140000000-0x000000014016D000-memory.dmp

memory/2908-8-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-58-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-61-0x0000000140000000-0x000000014016D000-memory.dmp

memory/1232-62-0x0000000140000000-0x000000014016D000-memory.dmp

\Users\Admin\AppData\Local\zL4d9m\DWWIN.EXE

MD5 71a27c0fdc30dd05a27335565080dbc1
SHA1 fa7505f59448692ce8324796a3036f8ee176e72b
SHA256 083669fdb1d74cfa14f8a9b6470d0ef65ceeac05246cc09d7a929a0d03a7fb98
SHA512 259b4c1932a523b21363959f58ea89d10f5b8394756a118cecdff4ca66cf6636172b7fbc9d30e4b2436076ed4857db94d307b04a54ee0ff001d45996ea30eb0b

C:\Users\Admin\AppData\Local\zL4d9m\DWWIN.EXE

MD5 bc1dd60ccbdec7cd62a4745fa2bb987a
SHA1 e571fbaed5060035eb1e3eca63cbbee933f65ce2
SHA256 3d00af313fdbf7cd89babef10ee04ef679a002cb891da2132d8e010d17c7e57c
SHA512 ff2cae5469a7fa91b6fd7037dfb275836c5e95f564b3fe07d9a736582c20bc770e916b40e4498e803a7c6b788a2582633f213ebddf48cb88f48d276aa374d518

memory/1232-74-0x00000000771D6000-0x00000000771D7000-memory.dmp

C:\Users\Admin\AppData\Local\zL4d9m\VERSION.dll

MD5 ed5728cdb48c479c7ee77446d21622d6
SHA1 295c534a4f4af113433f0f5a168b0ca0971084f2
SHA256 f4d2ca39ce0e2b0766dd455553f6787daf190da8390f783f2b0b604ab6e349f4
SHA512 04f78016883ca8b4aef96d7feb6c08ae073972d7e6c4598cad8f9cbf883d144a67f8f08b88de3bf86c074edc2b46c6f46843da64c127c8467a7722d77a372bc7

\Users\Admin\AppData\Local\zL4d9m\VERSION.dll

MD5 1a4de65fb84ac518d4961eb102d76a82
SHA1 9d300b7d920618d453eb2377db2ba24f7dc5e1a8
SHA256 248c514d6f76794d190a6d9e9324b78058db7cb3b3cc3bb1832c6f672784f383
SHA512 6ce382ed00f4b525b88e8fe97a25addde0d3aa938dca0d10c6ee3dd0217c870555c60c714179e5ae214495e7e868b8146f73767b1376dbfed0db90ea83bf2f63

memory/2332-77-0x0000000000080000-0x0000000000087000-memory.dmp

memory/2332-78-0x0000000140000000-0x000000014016E000-memory.dmp

memory/2332-83-0x0000000140000000-0x000000014016E000-memory.dmp

C:\Users\Admin\AppData\Local\zL4d9m\DWWIN.EXE

MD5 25247e3c4e7a7a73baeea6c0008952b1
SHA1 8087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256 c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512 bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b

\Users\Admin\AppData\Local\TGU2GL1F\Netplwiz.exe

MD5 e43ec3c800d4c0716613392e81fba1d9
SHA1 37de6a235e978ecf3bb0fc2c864016c5b0134348
SHA256 636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c
SHA512 176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08

C:\Users\Admin\AppData\Local\TGU2GL1F\NETPLWIZ.dll

MD5 e6713cb31b99985ebcb8a22065e28fa4
SHA1 51b1856258d7cf4822d60d960fa0b67ba063e019
SHA256 5ec9c5dc2a0beadad3bae5e54850dd749b23f397c0a667cf2bf2a9b3a6ea6484
SHA512 22dfb8edbbe1f3c16b38f727daa03636c315fb0242665c7bac866bdd762b9c6dde4d5e0ee4f7da0079011d4b5442c46b22038eb675514ed4702c19b40b19c58b

memory/744-95-0x00000000001F0000-0x00000000001F7000-memory.dmp

memory/744-101-0x0000000140000000-0x000000014016E000-memory.dmp

\Users\Admin\AppData\Local\ZcRUKPq\SystemPropertiesPerformance.exe

MD5 870726cdcc241a92785572628b89cc07
SHA1 63d47cc4fe9beb75862add1abca1d8ae8235710a
SHA256 1ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6
SHA512 89b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72

C:\Users\Admin\AppData\Local\ZcRUKPq\SYSDM.CPL

MD5 7a6f192e8b3ea62d3576b9ba6deff90c
SHA1 9a1f39cbcf75d7819fc211b9babb9c4db31c4db8
SHA256 ba1505c17f550c9ffc8da395f1b2acfca0249510565083295ca108be34c25cbb
SHA512 2638f5153cf1463c2cdfa93ccd15840c15be6304d9e10ae4d523c0e5b618256c05d83f38994efb3ed9cb14a131439450611f702a35892734b28b18023c9b49f9

memory/752-115-0x00000000000F0000-0x00000000000F7000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Hbeids.lnk

MD5 9ede39e90cef93326f93794bb2a9bc14
SHA1 1e0700a979b15ac9fe0179045664cb1a95f4afc1
SHA256 5ad74422ea60624c8e93090fb17281941edacd1b46ff1742d36fd3894a994700
SHA512 59032845657af5aa96bba9c47e2923c1f8a381d0d3cf59121aec62e9cc252a0cd498765d6707d9a6d0af0c9a6ec39a28028640565e94fa0ea398ecc0756d8ea2

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\fK\VERSION.dll

MD5 5329f7f976f38d7b5e16fb263183b84e
SHA1 e5c6c1eef62b2b8800e08ec3d3ffd4d4d7f16d14
SHA256 35bef5a45ee879f95458c8944e766359098221c5a641aadc9d9c2d0bf9cacaa8
SHA512 f0d7d195381942be78c39d2325cc787be76aafb50072b29569047cc47ff1c5720b92accbab1dda6c58e42a643c578b29855f702f93e24f07832a0c5a9e1e3bfc

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-06 10:17

Reported

2024-01-06 10:21

Platform

win10v2004-20231215-en

Max time kernel

157s

Max time network

166s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c668588dcb6a4b825f4486bdc405a86.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gdfgjdhwrlpouj = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\X2hKcdm51I1\\Netplwiz.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Xi3T1\bdeunlock.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\gGUYjD\Netplwiz.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\kf1Tkk2\printfilterpipelinesvc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3476 wrote to memory of 1036 N/A N/A C:\Windows\system32\bdeunlock.exe
PID 3476 wrote to memory of 1036 N/A N/A C:\Windows\system32\bdeunlock.exe
PID 3476 wrote to memory of 2532 N/A N/A C:\Users\Admin\AppData\Local\Xi3T1\bdeunlock.exe
PID 3476 wrote to memory of 2532 N/A N/A C:\Users\Admin\AppData\Local\Xi3T1\bdeunlock.exe
PID 3476 wrote to memory of 2004 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 3476 wrote to memory of 2004 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 3476 wrote to memory of 4900 N/A N/A C:\Users\Admin\AppData\Local\gGUYjD\Netplwiz.exe
PID 3476 wrote to memory of 4900 N/A N/A C:\Users\Admin\AppData\Local\gGUYjD\Netplwiz.exe
PID 3476 wrote to memory of 4216 N/A N/A C:\Windows\system32\printfilterpipelinesvc.exe
PID 3476 wrote to memory of 4216 N/A N/A C:\Windows\system32\printfilterpipelinesvc.exe
PID 3476 wrote to memory of 1976 N/A N/A C:\Users\Admin\AppData\Local\kf1Tkk2\printfilterpipelinesvc.exe
PID 3476 wrote to memory of 1976 N/A N/A C:\Users\Admin\AppData\Local\kf1Tkk2\printfilterpipelinesvc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c668588dcb6a4b825f4486bdc405a86.dll,#1

C:\Windows\system32\bdeunlock.exe

C:\Windows\system32\bdeunlock.exe

C:\Users\Admin\AppData\Local\Xi3T1\bdeunlock.exe

C:\Users\Admin\AppData\Local\Xi3T1\bdeunlock.exe

C:\Windows\system32\Netplwiz.exe

C:\Windows\system32\Netplwiz.exe

C:\Users\Admin\AppData\Local\gGUYjD\Netplwiz.exe

C:\Users\Admin\AppData\Local\gGUYjD\Netplwiz.exe

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Users\Admin\AppData\Local\kf1Tkk2\printfilterpipelinesvc.exe

C:\Users\Admin\AppData\Local\kf1Tkk2\printfilterpipelinesvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 83.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 22.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/2080-0-0x0000000140000000-0x000000014016D000-memory.dmp

memory/2080-2-0x000001D6AA0C0000-0x000001D6AA0C7000-memory.dmp

memory/3476-4-0x00000000030A0000-0x00000000030A1000-memory.dmp

memory/3476-6-0x0000000140000000-0x000000014016D000-memory.dmp

memory/2080-7-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-8-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-10-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-11-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-12-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-14-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-15-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-13-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-9-0x00007FF9BF6DA000-0x00007FF9BF6DB000-memory.dmp

memory/3476-16-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-17-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-18-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-20-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-21-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-22-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-23-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-19-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-24-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-25-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-26-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-27-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-28-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-30-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-29-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-31-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-32-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-33-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-34-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-35-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-36-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-37-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-38-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-39-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-40-0x0000000003060000-0x0000000003067000-memory.dmp

memory/3476-47-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-48-0x00007FF9C0740000-0x00007FF9C0750000-memory.dmp

memory/3476-57-0x0000000140000000-0x000000014016D000-memory.dmp

memory/3476-59-0x0000000140000000-0x000000014016D000-memory.dmp

C:\Users\Admin\AppData\Local\Xi3T1\bdeunlock.exe

MD5 fef5d67150c249db3c1f4b30a2a5a22e
SHA1 41ca037b0229be9338da4d78244b4f0ea5a3d5f3
SHA256 dcfdd67bf3244ff86cadaaea50b43cce5479014ea2021c0c2fb40b7c856e5603
SHA512 4ded9ca87d9d30c31ab2baededaa6e26681741ea1742d80c318173536c643a01bc049e03a03c3b45b3cb8860464a855830e12e87670503e65eedcdd5e9b2d1e7

C:\Users\Admin\AppData\Local\Xi3T1\DUser.dll

MD5 8a4a0ac15b552e2ef2e8086eb58a7c3d
SHA1 1e560fd7190daef077d9c4d50faa5ea0f88f41a1
SHA256 4318d4f08b946d75e601c7751e21a5acf7ec1b4365a32e50d0e7e0a6a9dc7d7e
SHA512 9e40dd91ad68ba6112c49c86695d42b8beecf6fd14c2c33d2e77b7c6b831c1230c6ff28fa8eaa4d49d421d14980bf3f7d319e5bfae3e6d104dfaa25d8d2e48e6

memory/2532-68-0x00000226DEBA0000-0x00000226DEBA7000-memory.dmp

memory/2532-69-0x0000000140000000-0x000000014016F000-memory.dmp

memory/2532-74-0x0000000140000000-0x000000014016F000-memory.dmp

C:\Users\Admin\AppData\Local\gGUYjD\Netplwiz.exe

MD5 520a7b7065dcb406d7eca847b81fd4ec
SHA1 d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA256 8323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA512 7aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914

C:\Users\Admin\AppData\Local\gGUYjD\NETPLWIZ.dll

MD5 9ca1b2e9f5540fe31c9d7e0b8c69ec8b
SHA1 83554d35235afff42f4e53f3bb5effac549a9c34
SHA256 398a2d669456f27a5ccfb5cabe418562cdb6f715f46791da46cf50294bf6bb44
SHA512 c8f53267f9a72c0cf94e90a66b6dacb51593480872bdab53f0242a52ef8de31a2062d53fa5a58b6f6286521294ac11fb59261b470827180cf248db73f89a198c

memory/4900-85-0x0000000140000000-0x000000014016E000-memory.dmp

memory/4900-86-0x000001AC13110000-0x000001AC13117000-memory.dmp

memory/4900-91-0x0000000140000000-0x000000014016E000-memory.dmp

C:\Users\Admin\AppData\Local\kf1Tkk2\printfilterpipelinesvc.exe

MD5 331a40eabaa5870e316b401bd81c4861
SHA1 ddff65771ca30142172c0d91d5bfff4eb1b12b73
SHA256 105099819555ed87ef3dab70a2eaf2cb61076f453266cec57ffccb8f4c00df88
SHA512 29992dbf10f327d77865af5e6ebbe66b937a5b4ad04c68cafbf4e6adbd6c6532c8a82ac7e638d97c1f053353a7c8a6d7e379f389af15443c94a1e8f9b16be5f8

C:\Users\Admin\AppData\Local\kf1Tkk2\XmlLite.dll

MD5 16e6faf9eda4132d6c4ec06551df9478
SHA1 352937def9dd6a64c20b3ff3d70c5488a049d583
SHA256 de877ed3ca14f453aa0b74c5e3c958874d2b3645302088485a2b3d2e4e406e44
SHA512 c2bbf72cb8c4af0b8761ec671e4aae8043a2f4f7046976598b750bfcd7f19916d64eb6ead9efe599dd1a9e68b43849e3d26fbef3315ada0708668e3ecf67db45

memory/1976-104-0x000002ED864C0000-0x000002ED864C7000-memory.dmp

memory/1976-110-0x0000000140000000-0x000000014016E000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

MD5 bbade73b77ee443c5cea642b0c981852
SHA1 8e48760445c0420db0432b904387328826446b13
SHA256 bb2aea3328dc29b2be285d95a51039cb470ee32cc6079b9e003feb7f44e22e4a
SHA512 d8ef32f9a840b03f3d93d2278463ac8280f97ed5f6e6ead648dc80c748b76b6727a1845635d852580368e67cc0a1b5f79757d51bee351eae09104fe36412aa40