Malware Analysis Report

2024-11-15 08:50

Sample ID 240119-e6w65sffa3
Target 66b58767a74baad1c7515631dc19f40d
SHA256 cf999aa80ee97169297cb4ba12d751d3b0bf3195f85022adf03933d10cb43641
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cf999aa80ee97169297cb4ba12d751d3b0bf3195f85022adf03933d10cb43641

Threat Level: Known bad

The file 66b58767a74baad1c7515631dc19f40d was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Drops startup file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Uses Task Scheduler COM API

Suspicious use of UnmapMainImage

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-19 04:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-19 04:33

Reported

2024-01-19 04:36

Platform

win7-20231215-en

Max time kernel

150s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b58767a74baad1c7515631dc19f40d.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\PL9y\rekeywiz.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\M8jH9THJF\mblctr.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\vTCeBnl\tabcal.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fskzoiv = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\ACCESS~1\\ACCESS~1\\TKIrDggP\\mblctr.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\PL9y\rekeywiz.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\M8jH9THJF\mblctr.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\vTCeBnl\tabcal.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1276 wrote to memory of 2648 N/A N/A C:\Windows\system32\rekeywiz.exe
PID 1276 wrote to memory of 2648 N/A N/A C:\Windows\system32\rekeywiz.exe
PID 1276 wrote to memory of 2648 N/A N/A C:\Windows\system32\rekeywiz.exe
PID 1276 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\PL9y\rekeywiz.exe
PID 1276 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\PL9y\rekeywiz.exe
PID 1276 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\PL9y\rekeywiz.exe
PID 1276 wrote to memory of 2912 N/A N/A C:\Windows\system32\mblctr.exe
PID 1276 wrote to memory of 2912 N/A N/A C:\Windows\system32\mblctr.exe
PID 1276 wrote to memory of 2912 N/A N/A C:\Windows\system32\mblctr.exe
PID 1276 wrote to memory of 3056 N/A N/A C:\Users\Admin\AppData\Local\M8jH9THJF\mblctr.exe
PID 1276 wrote to memory of 3056 N/A N/A C:\Users\Admin\AppData\Local\M8jH9THJF\mblctr.exe
PID 1276 wrote to memory of 3056 N/A N/A C:\Users\Admin\AppData\Local\M8jH9THJF\mblctr.exe
PID 1276 wrote to memory of 1864 N/A N/A C:\Windows\system32\tabcal.exe
PID 1276 wrote to memory of 1864 N/A N/A C:\Windows\system32\tabcal.exe
PID 1276 wrote to memory of 1864 N/A N/A C:\Windows\system32\tabcal.exe
PID 1276 wrote to memory of 1908 N/A N/A C:\Users\Admin\AppData\Local\vTCeBnl\tabcal.exe
PID 1276 wrote to memory of 1908 N/A N/A C:\Users\Admin\AppData\Local\vTCeBnl\tabcal.exe
PID 1276 wrote to memory of 1908 N/A N/A C:\Users\Admin\AppData\Local\vTCeBnl\tabcal.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b58767a74baad1c7515631dc19f40d.dll,#1

C:\Windows\system32\rekeywiz.exe

C:\Windows\system32\rekeywiz.exe

C:\Users\Admin\AppData\Local\PL9y\rekeywiz.exe

C:\Users\Admin\AppData\Local\PL9y\rekeywiz.exe

C:\Windows\system32\mblctr.exe

C:\Windows\system32\mblctr.exe

C:\Users\Admin\AppData\Local\M8jH9THJF\mblctr.exe

C:\Users\Admin\AppData\Local\M8jH9THJF\mblctr.exe

C:\Windows\system32\tabcal.exe

C:\Windows\system32\tabcal.exe

C:\Users\Admin\AppData\Local\vTCeBnl\tabcal.exe

C:\Users\Admin\AppData\Local\vTCeBnl\tabcal.exe

Network

N/A

Files

memory/2128-0-0x0000000140000000-0x0000000140168000-memory.dmp

memory/2128-1-0x00000000001B0000-0x00000000001B7000-memory.dmp

memory/1276-4-0x0000000077116000-0x0000000077117000-memory.dmp

memory/1276-5-0x0000000002B70000-0x0000000002B71000-memory.dmp

memory/1276-8-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-13-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-16-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-17-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-18-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-21-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-28-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-29-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-32-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-34-0x0000000002B50000-0x0000000002B57000-memory.dmp

memory/1276-33-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-30-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-41-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-31-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-42-0x0000000077321000-0x0000000077322000-memory.dmp

memory/1276-43-0x0000000077480000-0x0000000077482000-memory.dmp

memory/1276-27-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-26-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-25-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-24-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-23-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-22-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-20-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-19-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-15-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-14-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-12-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-11-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-10-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-9-0x0000000140000000-0x0000000140168000-memory.dmp

memory/2128-7-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-52-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1276-58-0x0000000140000000-0x0000000140168000-memory.dmp

C:\Users\Admin\AppData\Local\PL9y\rekeywiz.exe

MD5 767c75767b00ccfd41a547bb7b2adfff
SHA1 91890853a5476def402910e6507417d400c0d3cb
SHA256 bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512 f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9

\Users\Admin\AppData\Local\PL9y\rekeywiz.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\PL9y\slc.dll

MD5 f00cdcdef6cf5cb5b8773f998d25fb4d
SHA1 cb38a877023c8951acd5037277aab5b16a540268
SHA256 0cb0f14bd9dbe30b6670d7ec499b8d4a829465ed738b2a9862591851c148e004
SHA512 6d6011ae0afb9006743cedf55695f7959be0f35f6c3febe4f8d3760a04d6f7a963994f15e53c0fdff3c1cb0417bfadb31f477d657325d2a0295da3c758fe0a1e

\Users\Admin\AppData\Local\PL9y\slc.dll

MD5 478258024a59acc41f6e7d61917b173f
SHA1 b1dd8f829a4ec30c00d5a065f4a77f81f5f8606e
SHA256 4293dc0b2dee9c17c347667a1e4e16794599ceb8dca2f8d74513b5f4e0e55cdb
SHA512 01e8c4d0886c8fcde6ddb9de28e027632d88d11a6c8f4245983b308de77766771acdd398078efdd63a13987bd9f5c1dc6b66696975aafb04e817bf9d29299cd1

memory/2744-71-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2744-70-0x00000000003F0000-0x00000000003F7000-memory.dmp

memory/2744-76-0x0000000140000000-0x0000000140169000-memory.dmp

\Users\Admin\AppData\Local\M8jH9THJF\mblctr.exe

MD5 074df62c2a07202742b1b82b89aa7863
SHA1 9bb87aba089db42cbd5744a436880e8d272534c5
SHA256 24a6857d6a0d67edf424d838a4d36aa4bff889b8bf4372d025bab23963642bae
SHA512 f39aea6d33dd8909771bffc45b682878c28fc61c30748b281b14d6f7b277fc1bd83fe9cd351cf33422e59827f6e563855e611a20f9d1a14beb10e0aa0f099fd6

\Users\Admin\AppData\Local\M8jH9THJF\slc.dll

MD5 d2363bfb796c10b2aba0c9dea2b3619b
SHA1 29a7a7c7849cb541889a087c695437404d55b66f
SHA256 07f45c7fd93db5fc6f6dfad292b16c7ee57cdaa24f9ba612736dc818c7f7d35a
SHA512 bfb6ef4e44087ba7e6e06afad1964a4d8324d8b00981ac96c1db6e73ced47beb036dcac293036e3efd19d3691b2f1befbabed0259ceb17455de80adf33dae850

C:\Users\Admin\AppData\Local\M8jH9THJF\slc.dll

MD5 5a76b5c04a564b3d565453dcfc06eb75
SHA1 d075aec14f6c318a9bbe6d5904e6c8fc59c60dcc
SHA256 32a62934544cf2cbc89bb874a9e102685f9cf2d84571f35227f5835059a6d7b9
SHA512 439fdb8d8d78b14a11b342fb81f106a803ab7833c72fafbb7879dc70b9ec5e95587ce7beed89c0651261625b8788318d3c2a91c9723d2097ff0c7dae5a6bb524

memory/3056-88-0x00000000001A0000-0x00000000001A7000-memory.dmp

memory/3056-93-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Users\Admin\AppData\Local\M8jH9THJF\mblctr.exe

MD5 296c9ffbf084e80a35aecb3de1c10cf8
SHA1 d4546a21f1ea5d5b0af8df29bbce66c5b359a035
SHA256 93d56d9859c87573fecafe1563408205b29109cae6314dfaf3349e9c57a34c57
SHA512 5f510a3afda968507bb1ccb7213754ad4595d86ee79d06339ce9fc71f911acb72959c83ff5196dd5b6570b0e6ab2e63e587b1f84e5b313e00f07f3ac10e9e6bf

C:\Users\Admin\AppData\Local\M8jH9THJF\mblctr.exe

MD5 d01e4e8dcfa8052316005902d06eb37e
SHA1 e132ae028e18d2ec91d214562683842e025235f3
SHA256 f50976e2e591ac65750764abd5f9669a6df3d1780b00eba47624f2f46cebfafd
SHA512 fc9087de61a3a127e09081051a3dca12ef95db89ce5399b0dd979ad3e85468523c9dd1c16a9cebe95b8f4955e0e49a1f3f40ce71d1b7bb1a3e6023580166350f

C:\Users\Admin\AppData\Local\vTCeBnl\HID.DLL

MD5 a7e0028330d965f1d156dbf3f214a0b9
SHA1 50451b928c2a1144202d54b64443c0536f4bfe9c
SHA256 16eed4eadeb90c2f1616854c95b16fe43a124d57115f67bb4234278f005349fb
SHA512 d58b60881eceaa47e4ac5a034344556dd921ad789984cb9726b07d53de64576df4ff92f11543cf384a4fa39fcd1aa5628e337f2398641dc49c2c7162baf57f32

\Users\Admin\AppData\Local\vTCeBnl\HID.DLL

MD5 2922d5de3f83482ad3c92406bd61d0c2
SHA1 6c7619b06260f0e23c8a5f5a7902172f638031d2
SHA256 a524abfeb4fa79a82ae7439d1b305fae25847e0a131a33071fd7f45c6f896839
SHA512 c4d0a9c1b75aa568df9ae65839a49ee6874adcacc60e750184dcbd978a3848127d2eb0eb855145cccaf62524141490e40b1e4f7845f7788e8fd6fe140bce25b3

memory/1908-114-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1908-109-0x00000000003A0000-0x00000000003A7000-memory.dmp

C:\Users\Admin\AppData\Local\vTCeBnl\tabcal.exe

MD5 98e7911befe83f76777317ce6905666d
SHA1 2780088dffe1dd1356c5dd5112a9f04afee3ee8d
SHA256 3fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1
SHA512 fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6

\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\A4\tabcal.exe

MD5 0f0daad7caf706e01a0736da42fedccb
SHA1 e4f799f03edd3b183ace969ece1f344d711df993
SHA256 5497f211c33edec1f9861902fd21d0f8c9977d03ec087456d0770c84e9a34fd4
SHA512 acb455aa8a8a787d81a4b56ae1b4d63a91d8822b51b43fdfb148feab9d004b2a5ac27532f4f32368c27228b2191df4b668d5deeb68d5b1c81d053e022436e5bd

memory/1276-130-0x0000000077116000-0x0000000077117000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Zrkibbhbsqvuoso.lnk

MD5 e957fba34c20c9f85e0737d05baeb36c
SHA1 09babcaafcefad080d3d301a30fc6260e8985f77
SHA256 f4d69a6d90b9b486369ba71774290a9addd0c5aa9f2c57f36801d51b41c2d5df
SHA512 3855439864ad5cd6e044ae4433b5d01dc266cfa66b95fb6c772b7a0a59071e9edb1cb87c630135ec31e98c0ab16063709ee67cd6a88f26dd656a16166bf437cf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\72hrGvi2K\slc.dll

MD5 cab577c65e69c31ef9237156eb37b0e8
SHA1 d147ec6e9a087ebd6dd4fd4e1e418be976317696
SHA256 49dbf06533f64d6853c9e8401110db91149a5496e55cb55ae76a7b1a893e34ee
SHA512 91e35723bcb3a4da74dc959b647ef7a8a4550730ad0016d6aa49c60130b38c05e451913d738e628d6541693a470925998ab0f0bce016bf6245e82ba4f538a7d5

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\TKIrDggP\slc.dll

MD5 f4f2e0f173b7c2d0d57396cc773b65b5
SHA1 3b9b261bd5ea04384989ebdf00ed7c79e3cb3d71
SHA256 854cd6c1d01ee7542e54a3b8012b7599b0e37cf6145c6d134e4f309c1f2a2a06
SHA512 13e686cf5b957a356c0897c5950dba40bbb958e41d16c359bdfdc28d976eccd905818fe775061d5af3cfc722258688239aae669e3eea6d09e50176b090bf135e

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\A4\HID.DLL

MD5 79cf2db4455de7f73ae635eb8571fe0b
SHA1 fb97f898ef4e59379d68c448e81bbef0c9d3c845
SHA256 f9da4579d9600a6c9b53709143eeaf0810a9d7264e1a0fc7fe2a4fd33585cfd2
SHA512 02f725283489b2e62303bc02b7ece16fbf1a517befed19659ca22ee62f00766f5a9e73e04d38ffdcb47ff5b8881a9754750ab8f18603ce70a1847a13097d5d6b

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-19 04:33

Reported

2024-01-19 04:36

Platform

win10v2004-20231215-en

Max time kernel

125s

Max time network

130s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b58767a74baad1c7515631dc19f40d.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\p0RlpZzK6gn N/A N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\p0RlpZzK6gn\XmlLite.dll N/A N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\p0RlpZzK6gn\ddodiag.exe N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hwtkseldaftjsj = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\p0RlpZzK6gn\\ddodiag.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\5MWKwBHYC\SystemPropertiesHardware.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\DmqfV6ms6\ddodiag.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\xk8h71GN\omadmclient.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3488 wrote to memory of 3312 N/A N/A C:\Windows\system32\SystemPropertiesHardware.exe
PID 3488 wrote to memory of 3312 N/A N/A C:\Windows\system32\SystemPropertiesHardware.exe
PID 3488 wrote to memory of 4636 N/A N/A C:\Users\Admin\AppData\Local\5MWKwBHYC\SystemPropertiesHardware.exe
PID 3488 wrote to memory of 4636 N/A N/A C:\Users\Admin\AppData\Local\5MWKwBHYC\SystemPropertiesHardware.exe
PID 3488 wrote to memory of 388 N/A N/A C:\Windows\system32\consent.exe
PID 3488 wrote to memory of 388 N/A N/A C:\Windows\system32\consent.exe
PID 3488 wrote to memory of 2916 N/A N/A C:\Users\Admin\AppData\Local\ckaxRDN\consent.exe
PID 3488 wrote to memory of 2916 N/A N/A C:\Users\Admin\AppData\Local\ckaxRDN\consent.exe
PID 3488 wrote to memory of 3024 N/A N/A C:\Windows\system32\ddodiag.exe
PID 3488 wrote to memory of 3024 N/A N/A C:\Windows\system32\ddodiag.exe
PID 3488 wrote to memory of 3612 N/A N/A C:\Users\Admin\AppData\Local\DmqfV6ms6\ddodiag.exe
PID 3488 wrote to memory of 3612 N/A N/A C:\Users\Admin\AppData\Local\DmqfV6ms6\ddodiag.exe
PID 3488 wrote to memory of 1144 N/A N/A C:\Windows\system32\omadmclient.exe
PID 3488 wrote to memory of 1144 N/A N/A C:\Windows\system32\omadmclient.exe
PID 3488 wrote to memory of 2248 N/A N/A C:\Users\Admin\AppData\Local\xk8h71GN\omadmclient.exe
PID 3488 wrote to memory of 2248 N/A N/A C:\Users\Admin\AppData\Local\xk8h71GN\omadmclient.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b58767a74baad1c7515631dc19f40d.dll,#1

C:\Users\Admin\AppData\Local\xk8h71GN\omadmclient.exe

C:\Users\Admin\AppData\Local\xk8h71GN\omadmclient.exe

C:\Windows\system32\omadmclient.exe

C:\Windows\system32\omadmclient.exe

C:\Users\Admin\AppData\Local\DmqfV6ms6\ddodiag.exe

C:\Users\Admin\AppData\Local\DmqfV6ms6\ddodiag.exe

C:\Windows\system32\ddodiag.exe

C:\Windows\system32\ddodiag.exe

C:\Users\Admin\AppData\Local\ckaxRDN\consent.exe

C:\Users\Admin\AppData\Local\ckaxRDN\consent.exe

C:\Windows\system32\consent.exe

C:\Windows\system32\consent.exe

C:\Users\Admin\AppData\Local\5MWKwBHYC\SystemPropertiesHardware.exe

C:\Users\Admin\AppData\Local\5MWKwBHYC\SystemPropertiesHardware.exe

C:\Windows\system32\SystemPropertiesHardware.exe

C:\Windows\system32\SystemPropertiesHardware.exe

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/4120-1-0x0000000140000000-0x0000000140168000-memory.dmp

memory/4120-0-0x000002427D300000-0x000002427D307000-memory.dmp

memory/3488-4-0x0000000003610000-0x0000000003611000-memory.dmp

memory/4120-7-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-6-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-17-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-18-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-21-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-20-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-23-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-22-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-19-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-16-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-24-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-25-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-15-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-28-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-30-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-27-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-33-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-36-0x0000000001120000-0x0000000001127000-memory.dmp

memory/3488-32-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-31-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-29-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-26-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-14-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-13-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-12-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-11-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-9-0x00007FFEFA03A000-0x00007FFEFA03B000-memory.dmp

memory/3488-8-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-10-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-42-0x00007FFEFA3E0000-0x00007FFEFA3F0000-memory.dmp

memory/3488-41-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3488-53-0x0000000140000000-0x0000000140168000-memory.dmp

C:\Users\Admin\AppData\Local\5MWKwBHYC\SYSDM.CPL

MD5 9becf0eaa466f93349b296fe95f50d03
SHA1 f05eab6b4a041e386236d42275494a7d6dadd84c
SHA256 8d1d4a632313502f85e46ab4e3cfbc44a5fd0ae6cb8b52625de2ce9295f4ab95
SHA512 34ae90015af7e25c6a16dfad264cfebd1c3fd4e0bcc0ab8be5b56c1687daa8f3304367e186f46e671e551a827430b1a6acbc3f19f0534ac7d663134333a9c8e5

C:\Users\Admin\AppData\Local\5MWKwBHYC\SYSDM.CPL

MD5 1657cfc067fe91de086c24bb726d1943
SHA1 87dfc38e2fa660c9372d2a63aa38f55cb7f8360e
SHA256 fc83d91b4daa487294f38fb3bb02c48fff9f7332a4e84d8c6a89dc5d9056d875
SHA512 a117a086eb8cc1863aa617032d3aab86b2ff99198e7b18f2e5af05071245d201d4794a4d94e57dd6ae0880ad58a23c611362ba288fd39d71d80d212b9fe335b7

C:\Users\Admin\AppData\Local\5MWKwBHYC\SystemPropertiesHardware.exe

MD5 bf5bc0d70a936890d38d2510ee07a2cd
SHA1 69d5971fd264d8128f5633db9003afef5fad8f10
SHA256 c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7
SHA512 0e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51

memory/4636-68-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4636-63-0x0000020971970000-0x0000020971977000-memory.dmp

C:\Users\Admin\AppData\Local\DmqfV6ms6\XmlLite.dll

MD5 1389c23b07c8a25e292e12e66310f2c1
SHA1 8000969b9af4e9704e83f7ab292723da43009575
SHA256 556ebef22cd0d80cd2b016fe10efd5b0ed15a597ae1488b190f0b1f02cb9a0cb
SHA512 55001a5b13ae66a306a00f1b6f367518e58d724e3ae83187df05fa0dfcbf34194adbbd9d355e809ff09f0190960824c318ee928cdf1fa774fb9d1d95ee9bd4a6

memory/3612-93-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Users\Admin\AppData\Local\DmqfV6ms6\ddodiag.exe

MD5 85feee634a6aee90f0108e26d3d9bc1f
SHA1 a7b1fa32fe7ed67bd51dea438f2f767e3fef0ca2
SHA256 99c63175504781e9278824d487da082da7c014e99f1024227af164986d3a27c6
SHA512 b81a3e1723a5180c5168cd7bb5181c631f4f57c59780bb82a502160b7874777f3eef1ebe1b14f66c97f9f1a4721af13b6fbcdff2045c8563c18b5d12540953ff

C:\Users\Admin\AppData\Local\xk8h71GN\XmlLite.dll

MD5 5490b284ae504f3d5ad748235c40910b
SHA1 e007becbe5f93356918d6e316ce551d391430024
SHA256 27c3fb87ae5346c8d340b9ccce3445690cba919396a788229395372adc5b4230
SHA512 c2b2a67386d40dabfc5aafa39b6e3638a7c11cdad03aff9e729a45a0f015c7c8a04002fa516288ae38e9d64136baad42f957d4846e0167e5a98fd792aa50c5ff

memory/2248-110-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2248-107-0x000002EBDC4E0000-0x000002EBDC4E7000-memory.dmp

C:\Users\Admin\AppData\Local\xk8h71GN\XmlLite.dll

MD5 edc45517be95f74758fe159ba9ece7a1
SHA1 6df1203e21d6cc555befe6b430312376f9cdc90d
SHA256 53419f9de09773f0dd34a28038380286d4474c14436f921abfad4388501752c0
SHA512 856e132fd0c636fb4e7fd40f4672ea389fe14dc1d587f1f23299459482686ad725c113209f6d3561c1aa139369cfb43bd2bb52fdcbb365b121e5eefb7f8dc9da

C:\Users\Admin\AppData\Local\xk8h71GN\omadmclient.exe

MD5 403ea46a5b216dbada5b9a66b3031aa4
SHA1 af659f65b7e37339b111c4ab06dc9b9b49c37361
SHA256 9237f05192661b89a20c0b5ed9581d489585c982783a81d0970aaba635b89249
SHA512 d590d7101a52b9647d08b4ab5c47e07f2a244527ff01d9e8f44ab63911ffe7e803e35155c6d42c2a8590ef8de7561564de6c1b1510bdd3846cee420078810c5c

C:\Users\Admin\AppData\Local\xk8h71GN\omadmclient.exe

MD5 f0ef277737dabf16b52a4acf60ed5146
SHA1 87698ce0ba58280fde00f2be1e7eab850fe9a460
SHA256 cc596f2277b883f2740326d2c9183c99d232f80977b8d30b82892e7c30819cd5
SHA512 cffb294814e23c8aaef768712da2d62af17c9d9a7c3ece6384d65c7feaf15416716019bf92fe3a1f4022ba7ec204c84695a2bd35f378311f29d2bc03897be922

memory/3612-89-0x0000023179E80000-0x0000023179E87000-memory.dmp

C:\Users\Admin\AppData\Local\DmqfV6ms6\XmlLite.dll

MD5 fbe63f65c62052165e3cf82ef7d80873
SHA1 ab62f39145b01a38135efcbc448d858da8f05614
SHA256 452964b5b653d9ca566597388dfdd33a02dbf9bf2a78c6b844886528908b0399
SHA512 608b519d59f1241d37baaea9706b177e2454c5b48247b04fc64c12002bbb2fbf46c2037cce33df6948702e4c6e95e68c6e0961f01b40de303bed55b77aa3db04

C:\Users\Admin\AppData\Local\ckaxRDN\consent.exe

MD5 f14012de9453de18090da57482efec44
SHA1 b10d3693d20ac487d8a7ad72aef59069b6dc1cee
SHA256 e14bb8a9d2a3151e46de16134a3f5ba3d83d4b93c7c2ff7ffce9dc3cec807afe
SHA512 d0e96411cf6e95cbe5408cd5270df36c92325918356ce77bdd523ad07973abbcac465a7599086df696ea0f2d446f9d646480446c9e3295296928cc7aa6d35fa1

memory/4636-62-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3488-51-0x0000000140000000-0x0000000140168000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Mkzwiunlad.lnk

MD5 a3abddca61a5fb5258a83b9d6fc20f73
SHA1 9297f8df9f10d11bf095f5fae9b0bfd9eadccf60
SHA256 4216b3df40cb5d026fe68e59a91db42b09fd0215e4b96491612d93d676ce838a
SHA512 2958eab3a794e0986e4cd2af1646ed5f0f3f38345cd4118d68fe5d6540879d97b029ac8f57aa243ef46b07812d88f64a53cd9e1ca7c0eea6745a9256c87c0329

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\hoa7DJjyq\SYSDM.CPL

MD5 43f9b2ef10806ed46c67166e6d37c016
SHA1 b5f82510b57a6b059df2040cfbd4a1bc5e862ffd
SHA256 2cfac8ff17ba180fc77b9a20debc0b37c98add4fb24221aadb4379485c1b4ffc
SHA512 195dd8613448d2f975b2a59eac1b3ea3a3b9eb9797f404c07ec17938e07c361b8e928885096c72cd25a5b0a89f758dd75b35cfaab3b54230df615776eb5ea452

C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\p0RlpZzK6gn\XmlLite.dll

MD5 8368c263236aa10ca231e0edbe61723a
SHA1 232be5f5b0063e7cda0de861a2ad4f6101f307e0
SHA256 cc75253244aedf7ca8c10dae6e34454b510dc9a8c21e122fb5141990df02ada2
SHA512 b7db184dcc37a3e4586842d0a14d38ef57bd83e6af1bce785388ca03bc47aeb8b3bca3b3cf3fd33783cc924b7c5f905b31df6bbce5aa3006b69dfd6cf71c99fb

C:\Users\Admin\AppData\Roaming\Sun\Java\Deployment\arcklMd\XmlLite.dll

MD5 6260f862cfa3ac0298b5db3f15b30f25
SHA1 bc3912e439abf603c64b9bd4d62d7a7872e25d4a
SHA256 3244578bdf3a5b079fbb4fb86a688b4037b048d3d1b237b1c301dcc4a2b60c10
SHA512 c6ec558136887d3c8b62b27e0b856701a28bfaaed2b7e28c17f0f10047a0148231cf29cef5b003b563a44fce5a077a83ba2b54cb6f16fd444d5dad0cb03bfc05