Malware Analysis Report

2024-11-15 08:50

Sample ID 240119-s4pk6shdh8
Target 6800149dece7def1ad1cd84f715f4837
SHA256 b0d4e0d901760c1879169db38ef00435f986e19dda97a46b8797d55e379eb1ac
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b0d4e0d901760c1879169db38ef00435f986e19dda97a46b8797d55e379eb1ac

Threat Level: Known bad

The file 6800149dece7def1ad1cd84f715f4837 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Drops startup file

Loads dropped DLL

Executes dropped EXE

Checks whether UAC is enabled

Adds Run key to start application

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-19 15:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-19 15:40

Reported

2024-01-19 15:43

Platform

win7-20231215-en

Max time kernel

151s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\6800149dece7def1ad1cd84f715f4837.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\N0CE7X0Nj\MpSigStub.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\MKbqlZ\slui.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Xjmy6\irftp.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lgpbj = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FLASHP~1\\ASSETC~1\\2Q3NG7~1\\slui.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\N0CE7X0Nj\MpSigStub.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\MKbqlZ\slui.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Xjmy6\irftp.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1380 wrote to memory of 2100 N/A N/A C:\Windows\system32\MpSigStub.exe
PID 1380 wrote to memory of 2100 N/A N/A C:\Windows\system32\MpSigStub.exe
PID 1380 wrote to memory of 2100 N/A N/A C:\Windows\system32\MpSigStub.exe
PID 1380 wrote to memory of 2080 N/A N/A C:\Users\Admin\AppData\Local\N0CE7X0Nj\MpSigStub.exe
PID 1380 wrote to memory of 2080 N/A N/A C:\Users\Admin\AppData\Local\N0CE7X0Nj\MpSigStub.exe
PID 1380 wrote to memory of 2080 N/A N/A C:\Users\Admin\AppData\Local\N0CE7X0Nj\MpSigStub.exe
PID 1380 wrote to memory of 796 N/A N/A C:\Windows\system32\slui.exe
PID 1380 wrote to memory of 796 N/A N/A C:\Windows\system32\slui.exe
PID 1380 wrote to memory of 796 N/A N/A C:\Windows\system32\slui.exe
PID 1380 wrote to memory of 2524 N/A N/A C:\Users\Admin\AppData\Local\MKbqlZ\slui.exe
PID 1380 wrote to memory of 2524 N/A N/A C:\Users\Admin\AppData\Local\MKbqlZ\slui.exe
PID 1380 wrote to memory of 2524 N/A N/A C:\Users\Admin\AppData\Local\MKbqlZ\slui.exe
PID 1380 wrote to memory of 2480 N/A N/A C:\Windows\system32\irftp.exe
PID 1380 wrote to memory of 2480 N/A N/A C:\Windows\system32\irftp.exe
PID 1380 wrote to memory of 2480 N/A N/A C:\Windows\system32\irftp.exe
PID 1380 wrote to memory of 2020 N/A N/A C:\Users\Admin\AppData\Local\Xjmy6\irftp.exe
PID 1380 wrote to memory of 2020 N/A N/A C:\Users\Admin\AppData\Local\Xjmy6\irftp.exe
PID 1380 wrote to memory of 2020 N/A N/A C:\Users\Admin\AppData\Local\Xjmy6\irftp.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\6800149dece7def1ad1cd84f715f4837.dll,#1

C:\Windows\system32\MpSigStub.exe

C:\Windows\system32\MpSigStub.exe

C:\Users\Admin\AppData\Local\N0CE7X0Nj\MpSigStub.exe

C:\Users\Admin\AppData\Local\N0CE7X0Nj\MpSigStub.exe

C:\Windows\system32\slui.exe

C:\Windows\system32\slui.exe

C:\Users\Admin\AppData\Local\MKbqlZ\slui.exe

C:\Users\Admin\AppData\Local\MKbqlZ\slui.exe

C:\Windows\system32\irftp.exe

C:\Windows\system32\irftp.exe

C:\Users\Admin\AppData\Local\Xjmy6\irftp.exe

C:\Users\Admin\AppData\Local\Xjmy6\irftp.exe

Network

N/A

Files

memory/2412-1-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/2412-0-0x0000000000110000-0x0000000000117000-memory.dmp

memory/1380-4-0x00000000774E6000-0x00000000774E7000-memory.dmp

memory/1380-5-0x0000000002580000-0x0000000002581000-memory.dmp

memory/2412-8-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-10-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-11-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-13-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-14-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-15-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-18-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-17-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-19-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-21-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-23-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-24-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-27-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-31-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-32-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-29-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-33-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-35-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-37-0x0000000002560000-0x0000000002567000-memory.dmp

memory/1380-36-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-34-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-30-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-28-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-25-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-26-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-22-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-20-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-16-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-45-0x00000000776F1000-0x00000000776F2000-memory.dmp

memory/1380-44-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-12-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-9-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-7-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-46-0x0000000077850000-0x0000000077852000-memory.dmp

memory/1380-55-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1380-61-0x0000000140000000-0x00000001401B2000-memory.dmp

C:\Users\Admin\AppData\Local\N0CE7X0Nj\VERSION.dll

MD5 0a180432688c5f1d82b6e804a645b49f
SHA1 8f6129555c3c16233bac1b2b42afa73edf4c6140
SHA256 efd2fa65234a12b4951fd23f47c023a1a0777a19b522d54a7cdb7ac008f18448
SHA512 ae3c4717d7a9c575a9f5610f9aa07382aeae501b5f0881c732b6d6bf0200617e3ed6a64d1db7301eae9571b6cf428a00e8eaa3121e229b85a5394e5c743d304c

\Users\Admin\AppData\Local\N0CE7X0Nj\VERSION.dll

MD5 0d82712e20e6d2ffe6bdcc8fccab47eb
SHA1 4c112c2374b45035441e681c95270e9d5459e297
SHA256 66dba37dfc3361900d7df0a891bd9015c90b0d4698efb1fcb22b57c7b875024e
SHA512 27e4de9c1b1dbf87597c3c47941109733d587a983100635865732f56fa18f900cf41a61cefa6472162f77451ada3f996245d486e8d8df5f8afb4f2267df15c73

memory/2080-73-0x00000000000F0000-0x00000000000F7000-memory.dmp

memory/2080-74-0x0000000140000000-0x00000001401B3000-memory.dmp

memory/2080-79-0x0000000140000000-0x00000001401B3000-memory.dmp

C:\Users\Admin\AppData\Local\N0CE7X0Nj\MpSigStub.exe

MD5 2e6bd16aa62e5e95c7b256b10d637f8f
SHA1 350be084477b1fe581af83ca79eb58d4defe260f
SHA256 d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3
SHA512 1f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542

\Users\Admin\AppData\Local\MKbqlZ\slui.exe

MD5 c5ce5ce799387e82b7698a0ee5544a6d
SHA1 ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA256 34aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA512 79453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c

C:\Users\Admin\AppData\Local\MKbqlZ\WINBRAND.dll

MD5 0728b6d38c43ab4c1441f5b50ef84f8b
SHA1 f6e79eba7c46b2aaf2064a602833b154bb78b840
SHA256 871e191e8264b12bbcc31ec5aac58730052305a3954edf1245954c4e7a00223d
SHA512 fecdcf74615fa47b3080d57e28b78ba5a83ba5b9f3bf3ba7213c77d73a1fe1369aab2c19c8b6041e21e3a80b0761acdc37a059fa600e4355433e9be32319cffa

memory/2524-91-0x00000000002A0000-0x00000000002A7000-memory.dmp

memory/2524-95-0x0000000140000000-0x00000001401B3000-memory.dmp

\Users\Admin\AppData\Local\Xjmy6\irftp.exe

MD5 0cae1fb725c56d260bfd6feba7ae9a75
SHA1 102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256 312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512 db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec

C:\Users\Admin\AppData\Local\Xjmy6\WINMM.dll

MD5 c5ee14af829955b6e3b2e2440ca07531
SHA1 d3ecd740e4811fb2b44178d47fef6c5e1619fd4e
SHA256 6aa2ef4a4aa0b376510687f98ee84c2fa00542ec292196b349f41e07bd66c572
SHA512 f7188ca5b9277331f80b7c94259e8c5457f918a5d1fbc3ff1befe95a4dcd6734ca657dc886936826c915c748d51e0c428e7997deb6ca575b9b2dc9f2d25ab5f6

\Users\Admin\AppData\Local\Xjmy6\WINMM.dll

MD5 9a01f641327cb348e963d9db3ac04861
SHA1 e30770234e264bd6f2d5e1ec52cbafe7c0de39d3
SHA256 549b46f2a7d7e8e23f1879c66625bcfb7205f8abf11c0ec0a1d47cf4013e6f3f
SHA512 f19086dbf1ceb19ceb04154b2d02fc86ed0bc09a7a0d72e5f74e2e170371d5f4dc183aa6b76d5b98f36be09a83b41c1b98cee2a00180b3a850a2818bf4ef2887

memory/1380-109-0x00000000774E6000-0x00000000774E7000-memory.dmp

memory/2020-110-0x0000000140000000-0x00000001401B4000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yiudzqwx.lnk

MD5 1271bc34c68d9bb7129bb843d7d3618a
SHA1 a8c2c58bb14a6b01bf0797d91d2e51c50eb04752
SHA256 f075f9f631de7da818d8bc7848234abab9830969d771d80234bd65889d4fa44c
SHA512 d2835a4cf6860abc290e91f0686236422f2434334d65c4778c527c65b94fbd195fb31980813d2b22ee753f65995a37a7492010888ae886c7dbfc29b82ed5ca87

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\sZav1Zb\VERSION.dll

MD5 d74dd02041a8de8b2ae4fc0de5bdb0ca
SHA1 f2e370990662bb6bb588fd31830e7a44c5652b64
SHA256 4c2d5c56df7b719e34b54553dccab046172f2d650002af512ce1c0569db206ee
SHA512 7eb21cdc07e7afd3e3649c2f32b3ae3bbea2395cdaa2c1e30e65564e6886740b0b3b8be9ad8a338411921d17f95280100d8122e0a1e0b79e6e571580441fb51d

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\1bPZ8daX\WINMM.dll

MD5 eafa1afb468ea2986930ecfe7425e03f
SHA1 873b7bba20b6b16851f3602a2050ff205dea9c9b
SHA256 bcda63785ecebb671aa7b92bf736131fe65473a43c437fd7a6390eaa3f55a767
SHA512 ce7df400a40a746d3df2ad4a39debf36a597b67200e8fbfcc9d8ad21b9157892b9f8f4c2a9bdca33f1d1740e3b8ef0e32177a29ae06741a89c4c5188214d1439

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-19 15:40

Reported

2024-01-19 15:43

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\6800149dece7def1ad1cd84f715f4837.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\xU N/A N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\xU\SLC.dll N/A N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\xU\phoneactivate.exe N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kqgfxymewp = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AddIns\\gGXcOXyJ\\bdechangepin.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\CiCbzs\DWWIN.EXE N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\bmk\phoneactivate.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\dOQmhEld\bdechangepin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3428 wrote to memory of 2528 N/A N/A C:\Windows\system32\phoneactivate.exe
PID 3428 wrote to memory of 2528 N/A N/A C:\Windows\system32\phoneactivate.exe
PID 3428 wrote to memory of 4104 N/A N/A C:\Users\Admin\AppData\Local\bmk\phoneactivate.exe
PID 3428 wrote to memory of 4104 N/A N/A C:\Users\Admin\AppData\Local\bmk\phoneactivate.exe
PID 3428 wrote to memory of 2140 N/A N/A C:\Windows\system32\bdechangepin.exe
PID 3428 wrote to memory of 2140 N/A N/A C:\Windows\system32\bdechangepin.exe
PID 3428 wrote to memory of 1628 N/A N/A C:\Users\Admin\AppData\Local\dOQmhEld\bdechangepin.exe
PID 3428 wrote to memory of 1628 N/A N/A C:\Users\Admin\AppData\Local\dOQmhEld\bdechangepin.exe
PID 3428 wrote to memory of 4504 N/A N/A C:\Windows\system32\DWWIN.EXE
PID 3428 wrote to memory of 4504 N/A N/A C:\Windows\system32\DWWIN.EXE
PID 3428 wrote to memory of 1836 N/A N/A C:\Users\Admin\AppData\Local\CiCbzs\DWWIN.EXE
PID 3428 wrote to memory of 1836 N/A N/A C:\Users\Admin\AppData\Local\CiCbzs\DWWIN.EXE

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\6800149dece7def1ad1cd84f715f4837.dll,#1

C:\Windows\system32\bdechangepin.exe

C:\Windows\system32\bdechangepin.exe

C:\Users\Admin\AppData\Local\bmk\phoneactivate.exe

C:\Users\Admin\AppData\Local\bmk\phoneactivate.exe

C:\Windows\system32\phoneactivate.exe

C:\Windows\system32\phoneactivate.exe

C:\Users\Admin\AppData\Local\dOQmhEld\bdechangepin.exe

C:\Users\Admin\AppData\Local\dOQmhEld\bdechangepin.exe

C:\Windows\system32\DWWIN.EXE

C:\Windows\system32\DWWIN.EXE

C:\Users\Admin\AppData\Local\CiCbzs\DWWIN.EXE

C:\Users\Admin\AppData\Local\CiCbzs\DWWIN.EXE

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp

Files

memory/1956-2-0x0000022E43BB0000-0x0000022E43BB7000-memory.dmp

memory/1956-0-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-6-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-9-0x00007FF8D416A000-0x00007FF8D416B000-memory.dmp

memory/3428-15-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-23-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-32-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-37-0x00000000077D0000-0x00000000077D7000-memory.dmp

memory/3428-36-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-44-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-54-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-56-0x0000000140000000-0x00000001401B2000-memory.dmp

C:\Users\Admin\AppData\Local\bmk\phoneactivate.exe

MD5 8f1da0a9a064426a6abe855bef44f086
SHA1 3f55f4e8b6a33093955d2ca1c2664cdde2aa418d
SHA256 fc3d186e41115ca5f78c8f4f0816ea17fd0bbb6a3ea6c2509469b6f05cd17fc1
SHA512 5e99cf117a3c37c9384adc87f08bf7b2f24de06350b420c3ccd8d720c57596e700d96dbeb655a6bd5a68d31deec7ab8bd85ab905346a581bd2bb98e4d8ab9c9d

memory/4104-65-0x0000000140000000-0x00000001401B3000-memory.dmp

memory/4104-67-0x000001C476D40000-0x000001C476D47000-memory.dmp

memory/4104-71-0x0000000140000000-0x00000001401B3000-memory.dmp

C:\Users\Admin\AppData\Local\bmk\phoneactivate.exe

MD5 f0fced4adb6c801fb0c064919de13a81
SHA1 4e3b949f3c34a239ef1585ef72faeb9b2d1ce7b4
SHA256 1cef17759dafc96cf9c0bcc05597e82e58d93fb993bb89380d70601073116d3f
SHA512 d40cda5b686918242ac426111201975d295e045c20c47873e0a7292ede4de9e1681f83cce5c5c739953039cf4d975d19df81178e02f0bce8a7f3319ec85a26ec

C:\Users\Admin\AppData\Local\bmk\SLC.dll

MD5 c72f181b52fa983f304f0279bcbb6cf7
SHA1 76db629a11ba51b8bc8622f45dc70007b068a59f
SHA256 252ddbdeb49b8ed5e62316bf6e052449495e5bb1564fb48fe7b6a42a07247846
SHA512 44aed362c3e78eb6f07f7bd27771f718e87b259919a7065bd9277f726427da807a456aeaf43b64fcebef458c66f55f193c3abdcf4077a47a9958992cef9fd8e3

C:\Users\Admin\AppData\Local\bmk\SLC.dll

MD5 34b2388b1dbc77a73480bd5a22e9f9bd
SHA1 83f9cdfdc011daba7f6d9a7fb97d6f995d16edcc
SHA256 c0c474d0a4123405fc005afaf1907f4f20cd03566c6d1d5a50143171bca0b1d6
SHA512 041fe27943bb5d83d1e1aef5616d2c264569fac94217f2d07196d19cf6907f68c271fe4bf5e94d684d15526a5f98133b82ab5a5eb702baa2ed4014c937ba5588

memory/3428-45-0x00007FF8D54C0000-0x00007FF8D54D0000-memory.dmp

memory/3428-35-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-34-0x0000000140000000-0x00000001401B2000-memory.dmp

C:\Users\Admin\AppData\Local\dOQmhEld\DUI70.dll

MD5 cfd8e95f8287d61a786e276d8e97c3bb
SHA1 dc4cf6140b00526abf22ad108a081f05842203ab
SHA256 822e443ebcebf17e43860c51f347f53af6d987f7426ab8542f47185352ad0dfa
SHA512 b77cddbcbb1a9b3e1c91843fabab16b17d47959c25a8bb29a057953e3889e12ce867a8594376ded9d3e12878689b4910adcd9fe6862ac9385697906f3f37af30

memory/1628-88-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/1628-83-0x0000000140000000-0x00000001401F8000-memory.dmp

C:\Users\Admin\AppData\Local\CiCbzs\wer.dll

MD5 fd8991c07d66cf67388aa51bc97e0fb2
SHA1 4e3e84da81a7184765ff77b716c4614227943b7e
SHA256 3c81d339f0797cb88ea3750a3c27bfcfde78e491d2c426ca53082741f2ace1ed
SHA512 47605197a8f036f136a412a309840ccce3896b07ac3299d2bae9118393bb48c9fe2ce46d47b2b5005b1c776aac643e16dd943690c889b2f022d566dc69ca07f2

memory/1836-100-0x0000000140000000-0x00000001401B4000-memory.dmp

memory/1836-105-0x0000000140000000-0x00000001401B4000-memory.dmp

memory/1836-99-0x00000212E6500000-0x00000212E6507000-memory.dmp

C:\Users\Admin\AppData\Local\CiCbzs\DWWIN.EXE

MD5 0421f6cf16b6f260f7abb192eabe7908
SHA1 48fd7a3323d0e74b43f04ab302130533e0524683
SHA256 2d87807ae42d5dd9495333af481e04e4e2d6b367f6037cb30f6d6dfc51ce2c21
SHA512 a65483167481b7aebdc0c20da59e9b2beede817cc4c850515afbf56fd7bbe05b7032844efefc1f2700e37ef2c36ff1068264ba1f5d7522326d4de22303ad6a1e

C:\Users\Admin\AppData\Local\CiCbzs\wer.dll

MD5 d480acdfe977d360f9240ebb0d028b6a
SHA1 bf1f30e76973e6e075f573509e69651aef93ba2d
SHA256 6fc1cf20c924d5e8852c76ff9092417c44f5cf8adffcf741873cf6769a806e83
SHA512 ea77618f67ed3ac928edaa451790837a4058f51047e9967d3406391536bdfae74774912d8455fb5c55efbdc25c4be2c2b457ff72b966d8368c171862a82e3595

C:\Users\Admin\AppData\Local\CiCbzs\DWWIN.EXE

MD5 3fbe6d48bba609e9268e3addcfa90116
SHA1 7baaac0830008aef9d7b10e0b3758c4726067ef4
SHA256 10e05afa65984a980ba6ae38f7e0214b107a5ad7b9b39b973ce77fd0e90b9800
SHA512 bfea52ec1c57d0a06b217d16ab11b544fb7615c6222e12a82038dadcdcb98216c84849049be1b63d772bd8d948a57b5db95e9867b3d2ef0dd13e6750651bfb49

C:\Users\Admin\AppData\Local\dOQmhEld\bdechangepin.exe

MD5 2ddaceb9329188df81d152827c522ff2
SHA1 6ad57236b9282dce9c06d31da8ef3e5a93dd6765
SHA256 055e933059f86654e278de23a894b217a5d598909365b3e53c887dbe5ea1bb41
SHA512 c6204bd909069a2468d379fdc43aac1fe1e410b238f87b229713db25c1274c565fb00aa1dd7192c42736210004d699bf20e53ca7d1b6cb65f687b7ea5595af58

memory/1628-82-0x000001D8CE850000-0x000001D8CE857000-memory.dmp

C:\Users\Admin\AppData\Local\dOQmhEld\DUI70.dll

MD5 3227be4321a5f6d1b0c60692bbb4f840
SHA1 503c060d94ac2394da63d2737dafa0195033ecc5
SHA256 f909140f1bac5c07ceaac5db8fb8d56c03f69856742992ea05474fba3f7aa59a
SHA512 8734b43da0af5b53de3b67706ead70d30b6dad9750135475adcc93ab3407313ecf3e07656af558b99c198d0f82fc90e6005449e3fd2769a9099ef8e3117c26d1

C:\Users\Admin\AppData\Local\dOQmhEld\bdechangepin.exe

MD5 82ecf388046d1bcc111398fa74338241
SHA1 e82e91fc24907fc1a0727313cc2ebc4693fb9a11
SHA256 ac6afa17b9b9e4c6f3d186974f8e545c7bd3750b8522ecf360205d92cb490817
SHA512 e6fb2d85afed172dec5a43b8962d7e8c7cfc133d0d964036d9568a2b6d8c8039bc0aa4e56f4711683bbb3349674e9280faba872a57d808a03de661ece48885e6

memory/3428-33-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-31-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-30-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-29-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-28-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-27-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-26-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-25-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-24-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-22-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-21-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-20-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-19-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-18-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-17-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-16-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-13-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-14-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-12-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/1956-11-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-10-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-8-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-7-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3428-4-0x00000000077F0000-0x00000000077F1000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Psfjn.lnk

MD5 f44bd0b55c65be5607fff43bd9e72750
SHA1 2072a34bf47ed9c364d76504b06f8226fa822cdb
SHA256 0f590bc99ae423cccb129e420bb1b5654b656fa949a3907abc0f16e455f08c03
SHA512 1e868c977b782d2ed487eba7cff826475286d3e4b0553de3e195f30aff89b11dc5d0edc267796b0e66772056034593835877b8a2c4e5ec41749c9321fa904c7c

C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\xU\SLC.dll

MD5 9526d3ba3d00af14a6dc4382d106dee6
SHA1 8f6e94bcd940fae4d14b9e53aaf0f71d55247d02
SHA256 a332e44ae5bd9f4639a0fe935bd2e57860ecd6511619fbc81d539b3f7598f05d
SHA512 d7a5bab2ddbb9ae0c102d3ae729152a3d0c85af1503bbcdd753cb947db037c8f40bc935214eb95c87e3d9fa126d143c9a6d5abbfbd3abf06456a187b1770b147

C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\gGXcOXyJ\DUI70.dll

MD5 4a10af8e204db7bd5bb623ca53a2f4c7
SHA1 e7278518b7d911ea86a405f01348c813ace0092f
SHA256 19d00ce8600447410f84e4184ecd1ca4ee7ae8933cedfa9439e817f025623ef2
SHA512 6ee30f4b5294f1b99df6ca74bec3084c8281e7e24f7d2f2b587d6eb5cb69118b69e8a355d200ef8a53977ac86e072aa192e43b489b7182ca0635e6b2784abcee

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\ULxm\wer.dll

MD5 4302d04da11f6efd9a6b042c92fd45fe
SHA1 b4325a898c03b286fa58aefe6146fe3533c2bc88
SHA256 8ae4b9e68fb3327910f4b537e9a318947058b67aa1ff8baf54cf2fb0dbac465e
SHA512 8bbe2c5fe5fc7fc09843852729c1b9c407eee59aeacfe50e6ea23f4e09b8d7304fc748d9928509b89ad7fd288121528ae932ee9a848a754d39ef6d8c99f00836