Malware Analysis Report

2024-11-15 08:50

Sample ID 240120-cmcx2shgar
Target 661942dec5f555ea16390ab0b8805570.bin
SHA256 9fc724df4f2ae0f2d2b3a04540cf737782e0b77e296a03ec25418f3f36f05a6b
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9fc724df4f2ae0f2d2b3a04540cf737782e0b77e296a03ec25418f3f36f05a6b

Threat Level: Known bad

The file 661942dec5f555ea16390ab0b8805570.bin was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex payload

Dridex Shellcode

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-20 02:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-20 02:11

Reported

2024-01-20 02:13

Platform

win7-20231215-en

Max time kernel

150s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\661942dec5f555ea16390ab0b8805570.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\H8rgbmeSz\SystemPropertiesAdvanced.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\SBqVTmcXy\xpsrchvw.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\C0aS\mstsc.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fskzoiv = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\UserData\\5N9FPT~1\\xpsrchvw.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\H8rgbmeSz\SystemPropertiesAdvanced.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\SBqVTmcXy\xpsrchvw.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\C0aS\mstsc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1276 wrote to memory of 2648 N/A N/A C:\Windows\system32\SystemPropertiesAdvanced.exe
PID 1276 wrote to memory of 2648 N/A N/A C:\Windows\system32\SystemPropertiesAdvanced.exe
PID 1276 wrote to memory of 2648 N/A N/A C:\Windows\system32\SystemPropertiesAdvanced.exe
PID 1276 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\H8rgbmeSz\SystemPropertiesAdvanced.exe
PID 1276 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\H8rgbmeSz\SystemPropertiesAdvanced.exe
PID 1276 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\H8rgbmeSz\SystemPropertiesAdvanced.exe
PID 1276 wrote to memory of 3032 N/A N/A C:\Windows\system32\xpsrchvw.exe
PID 1276 wrote to memory of 3032 N/A N/A C:\Windows\system32\xpsrchvw.exe
PID 1276 wrote to memory of 3032 N/A N/A C:\Windows\system32\xpsrchvw.exe
PID 1276 wrote to memory of 3020 N/A N/A C:\Users\Admin\AppData\Local\SBqVTmcXy\xpsrchvw.exe
PID 1276 wrote to memory of 3020 N/A N/A C:\Users\Admin\AppData\Local\SBqVTmcXy\xpsrchvw.exe
PID 1276 wrote to memory of 3020 N/A N/A C:\Users\Admin\AppData\Local\SBqVTmcXy\xpsrchvw.exe
PID 1276 wrote to memory of 748 N/A N/A C:\Windows\system32\mstsc.exe
PID 1276 wrote to memory of 748 N/A N/A C:\Windows\system32\mstsc.exe
PID 1276 wrote to memory of 748 N/A N/A C:\Windows\system32\mstsc.exe
PID 1276 wrote to memory of 1984 N/A N/A C:\Users\Admin\AppData\Local\C0aS\mstsc.exe
PID 1276 wrote to memory of 1984 N/A N/A C:\Users\Admin\AppData\Local\C0aS\mstsc.exe
PID 1276 wrote to memory of 1984 N/A N/A C:\Users\Admin\AppData\Local\C0aS\mstsc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\661942dec5f555ea16390ab0b8805570.dll,#1

C:\Windows\system32\SystemPropertiesAdvanced.exe

C:\Windows\system32\SystemPropertiesAdvanced.exe

C:\Users\Admin\AppData\Local\H8rgbmeSz\SystemPropertiesAdvanced.exe

C:\Users\Admin\AppData\Local\H8rgbmeSz\SystemPropertiesAdvanced.exe

C:\Windows\system32\xpsrchvw.exe

C:\Windows\system32\xpsrchvw.exe

C:\Users\Admin\AppData\Local\SBqVTmcXy\xpsrchvw.exe

C:\Users\Admin\AppData\Local\SBqVTmcXy\xpsrchvw.exe

C:\Windows\system32\mstsc.exe

C:\Windows\system32\mstsc.exe

C:\Users\Admin\AppData\Local\C0aS\mstsc.exe

C:\Users\Admin\AppData\Local\C0aS\mstsc.exe

Network

N/A

Files

memory/1268-1-0x0000000001B40000-0x0000000001B47000-memory.dmp

memory/1268-0-0x000007FEF69D0000-0x000007FEF6AA4000-memory.dmp

memory/1276-3-0x0000000077116000-0x0000000077117000-memory.dmp

memory/1276-4-0x0000000002B70000-0x0000000002B71000-memory.dmp

memory/1276-7-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-8-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-11-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-13-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-15-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-16-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-18-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-20-0x0000000002B50000-0x0000000002B57000-memory.dmp

memory/1276-19-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-17-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-14-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-12-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-10-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-9-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-6-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-27-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-29-0x00000000774B0000-0x00000000774B2000-memory.dmp

memory/1276-28-0x0000000077480000-0x0000000077482000-memory.dmp

memory/1276-40-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1276-38-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1268-41-0x000007FEF69D0000-0x000007FEF6AA4000-memory.dmp

\Users\Admin\AppData\Local\H8rgbmeSz\SystemPropertiesAdvanced.exe

MD5 25dc1e599591871c074a68708206e734
SHA1 27a9dffa92d979d39c07d889fada536c062dac77
SHA256 a13b2ba5892c11c731869410b1e3dd2f250d70ff9efd513a9f260ab506dd42ef
SHA512 f7da9ce4c3e8aea9095fcc977084c042f85df48fca0b58fb136dfd835ce69b5b1e68f3c11eeb14c617ffcec7011ffc7e5d5a948f49dde653a2348b28e10adb72

C:\Users\Admin\AppData\Local\H8rgbmeSz\SYSDM.CPL

MD5 7c71547fee3b5b517809132b9771e082
SHA1 d89b5d1fae6f7d45cb0638caa14d2fcc50aa06fe
SHA256 cdb78b85e57a96c59be403c1d58c23d3a05fc4837f5b92c00cf7934b4ee9f5d4
SHA512 69fab62d9daa4ee725d158f26c412f812dc9e6e258c47480c3fbf8d1d140c06533a530a3a657865bb04f5b2393a4a98cb52d8d3988d731ba3cf19a91f5863701

memory/2744-55-0x000007FEF6AB0000-0x000007FEF6B85000-memory.dmp

memory/2744-57-0x0000000000170000-0x0000000000177000-memory.dmp

memory/2744-60-0x000007FEF6AB0000-0x000007FEF6B85000-memory.dmp

\Users\Admin\AppData\Local\SBqVTmcXy\xpsrchvw.exe

MD5 b1a23481a00c0d3f60e9c78a16870359
SHA1 4b42250c20415b4fa0f874336f10d4441c3904e7
SHA256 a51782b21b224399b500d9bc5588863afdbf2e9aa117106d2cfda27924c73e05
SHA512 16307a68a5057c5fdd2b399bbf101639b252bd03871d1915a209842bcb8aa7fd98dfa4653ab613591af0d25a37bad8cc4451a9579c4c9974bf572c9f0c4c3167

C:\Users\Admin\AppData\Local\SBqVTmcXy\WINMM.dll

MD5 e5ce4daf77f8d529ed3a1f2e7c0875ec
SHA1 83fe8477f27611668034c55e340a28d4cf14f9f6
SHA256 3074d49a74805ba97c408c512a9f1644ddcb3516c22d652a8aa55667153c37fb
SHA512 a055022c3c006650f3eb11afe7a50e78ea67ddb920ed489fc2e116b03dc45296b123dc649bd78e593df332926f47de6ddcc707a78d99e704375a1b4608863b20

C:\Users\Admin\AppData\Local\SBqVTmcXy\xpsrchvw.exe

MD5 051bdf75fa2555be765d21abff20cd7a
SHA1 c1d63d4f22f5a3290c47a7f796fff1d0ccdb994c
SHA256 1c8afcc609898fd39f6e46858779679009f8799d5bfa3be4c44a74a5307f4dd9
SHA512 d2c51be95d0246221272f80ba0374f9f6ccd6b79d0e8c2a34a197a20776605827c2e1f8488cba6faeefd52835b0367e08ce01c6d16f0fb130898a8fa2fe31825

memory/3020-74-0x00000000001E0000-0x00000000001E7000-memory.dmp

memory/1276-73-0x0000000077116000-0x0000000077117000-memory.dmp

memory/3020-72-0x000007FEF6470000-0x000007FEF6546000-memory.dmp

memory/3020-77-0x000007FEF6470000-0x000007FEF6546000-memory.dmp

C:\Users\Admin\AppData\Local\SBqVTmcXy\xpsrchvw.exe

MD5 492cb6a624d5dad73ee0294b5db37dd6
SHA1 e74806af04a5147ccabfb5b167eb95a0177c43b3
SHA256 ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784
SHA512 63bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835

\Users\Admin\AppData\Local\C0aS\mstsc.exe

MD5 50f739538ef014b2e7ec59431749d838
SHA1 b439762b8efe8cfb977e7374c11a7e4d8ed05eb3
SHA256 85c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3
SHA512 02e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8

C:\Users\Admin\AppData\Local\C0aS\Secur32.dll

MD5 240aad42236aeb13e86146f82702e653
SHA1 fb2728ae3870730256f927cfb327effa0db99eef
SHA256 b97ada4dee841c40002f69601879ff0b22a8a0c51bc152038352947e5b2469be
SHA512 66093dc83b492f7d118d7aeefabf0319d59961c04dab3adc55933f84d8721b4ff94ac93a77d97126b0cf7b7dfca24629f57679e3916dc561d9836f5f4fd300b8

memory/1984-97-0x0000000000110000-0x0000000000117000-memory.dmp

memory/1984-98-0x000007FEF6470000-0x000007FEF6545000-memory.dmp

memory/1984-102-0x000007FEF6470000-0x000007FEF6545000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Zrkibbhbsqvuoso.lnk

MD5 28a3210bb8de6ea2c17095e313b4b481
SHA1 8948483251500430c10e7514a23ce511ef95add5
SHA256 33c95fd4753130fce135f7ad669550ed3c523aae9995a9a77c7e085141f883ce
SHA512 b9d612c011c6117d0e5751cdb274e07deb8020c612a985d154cbd6154455c02ec620415c9d8585eb06b7f1a1e561125a4877f41428d53b1fce1196bba259626c

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-20 02:11

Reported

2024-01-20 02:13

Platform

win10v2004-20231222-en

Max time kernel

150s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\661942dec5f555ea16390ab0b8805570.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mbfbagbrjs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Proof\\9T5KEHd\\ie4ushowIE.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\HZCcvCJSG\ie4ushowIE.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\bkdi\SystemPropertiesProtection.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\jdg52\osk.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3424 wrote to memory of 1484 N/A N/A C:\Windows\system32\osk.exe
PID 3424 wrote to memory of 1484 N/A N/A C:\Windows\system32\osk.exe
PID 3424 wrote to memory of 5028 N/A N/A C:\Users\Admin\AppData\Local\jdg52\osk.exe
PID 3424 wrote to memory of 5028 N/A N/A C:\Users\Admin\AppData\Local\jdg52\osk.exe
PID 3424 wrote to memory of 4376 N/A N/A C:\Windows\system32\ie4ushowIE.exe
PID 3424 wrote to memory of 4376 N/A N/A C:\Windows\system32\ie4ushowIE.exe
PID 3424 wrote to memory of 1136 N/A N/A C:\Users\Admin\AppData\Local\HZCcvCJSG\ie4ushowIE.exe
PID 3424 wrote to memory of 1136 N/A N/A C:\Users\Admin\AppData\Local\HZCcvCJSG\ie4ushowIE.exe
PID 3424 wrote to memory of 2972 N/A N/A C:\Windows\system32\SystemPropertiesProtection.exe
PID 3424 wrote to memory of 2972 N/A N/A C:\Windows\system32\SystemPropertiesProtection.exe
PID 3424 wrote to memory of 1508 N/A N/A C:\Users\Admin\AppData\Local\bkdi\SystemPropertiesProtection.exe
PID 3424 wrote to memory of 1508 N/A N/A C:\Users\Admin\AppData\Local\bkdi\SystemPropertiesProtection.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\661942dec5f555ea16390ab0b8805570.dll,#1

C:\Windows\system32\osk.exe

C:\Windows\system32\osk.exe

C:\Users\Admin\AppData\Local\jdg52\osk.exe

C:\Users\Admin\AppData\Local\jdg52\osk.exe

C:\Windows\system32\ie4ushowIE.exe

C:\Windows\system32\ie4ushowIE.exe

C:\Users\Admin\AppData\Local\HZCcvCJSG\ie4ushowIE.exe

C:\Users\Admin\AppData\Local\HZCcvCJSG\ie4ushowIE.exe

C:\Windows\system32\SystemPropertiesProtection.exe

C:\Windows\system32\SystemPropertiesProtection.exe

C:\Users\Admin\AppData\Local\bkdi\SystemPropertiesProtection.exe

C:\Users\Admin\AppData\Local\bkdi\SystemPropertiesProtection.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 81.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
GB 96.17.178.196:80 tcp

Files

memory/3696-0-0x00007FFDD21C0000-0x00007FFDD2294000-memory.dmp

memory/3696-2-0x000002218B8C0000-0x000002218B8C7000-memory.dmp

memory/3424-4-0x00007FFDDF67A000-0x00007FFDDF67B000-memory.dmp

memory/3424-3-0x00000000076C0000-0x00000000076C1000-memory.dmp

memory/3424-6-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-7-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-8-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-9-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-10-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-11-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-12-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-13-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-17-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-18-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-19-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-16-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-21-0x00000000034A0000-0x00000000034A7000-memory.dmp

memory/3424-15-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-14-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-27-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3424-28-0x00007FFDE0D40000-0x00007FFDE0D50000-memory.dmp

memory/3424-29-0x00007FFDE0D30000-0x00007FFDE0D40000-memory.dmp

memory/3424-38-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/3696-40-0x00007FFDD21C0000-0x00007FFDD2294000-memory.dmp

C:\Users\Admin\AppData\Local\jdg52\osk.exe

MD5 745f2df5beed97b8c751df83938cb418
SHA1 2f9fc33b1bf28e0f14fd75646a7b427ddbe14d25
SHA256 f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51
SHA512 2125d021e6f45a81bd75c9129f4b098ad9aa15c25d270051f4da42458a9737bff44d6adf17aa1f2547715d159fb621829f7cd3b9d42f1521c919549cc7deb228

C:\Users\Admin\AppData\Local\jdg52\dwmapi.dll

MD5 b6512551747e9876b9547c207dfd8389
SHA1 cfcb0bf5ff3ae088451234a75a7760d3337266f4
SHA256 6f6c948500d789448cddec12de1510f9e997f9b524733d2eeecc3cf83aee7297
SHA512 1afdcd620d220d5d04296e15a0c6f75fc988e2d29dc0b75d6ca0f027e11a38c03decaccf393fd3cd3c2d05eaf23d57c90f9ebbd4252aa90b9edbbb89812803ab

C:\Users\Admin\AppData\Local\jdg52\dwmapi.dll

MD5 0db40375dc6678268d93ffbfa66c7cb1
SHA1 a0af55217b7107291ce53919f2458f4f467403ba
SHA256 cddf7a539b857707e8b56331aef92cf0306a13aabbb857b450e5b0c0d5784da5
SHA512 32e4cf959a5b70f910abc8c68b25ffe4d7397d42bf45495e6a204d9e33e64a40ddec8fd606804b9d6512d99939c43c93cd9fb096ad99bdf82e44ddc700fed2d0

memory/5028-48-0x00007FFDC1D80000-0x00007FFDC1E55000-memory.dmp

memory/5028-49-0x000001B243E80000-0x000001B243E87000-memory.dmp

memory/5028-53-0x00007FFDC1D80000-0x00007FFDC1E55000-memory.dmp

C:\Users\Admin\AppData\Local\HZCcvCJSG\ie4ushowIE.exe

MD5 9de952f476abab0cd62bfd81e20a3deb
SHA1 109cc4467b78dad4b12a3225020ea590bccee3e6
SHA256 e9cb6336359ac6f71ac75af2836efb28daa3bafd10a1f0b775dcdc2ec8850a6b
SHA512 3cbe50a146ca50b0657a78a2d89a34630c69823005668906785b2d2015cc6139c8dbbf7aefa5fe55957ef55ae06e758933b3b41eaf822e49dba3b7700582e2c9

C:\Users\Admin\AppData\Local\HZCcvCJSG\VERSION.dll

MD5 38dea28f7bb585d0b83c3fcead8eeba8
SHA1 f8f5d24fef8ffdf7a3a73a7b11f05899a421feb5
SHA256 72f582e9fe1c1f09a9596af39879991e745eafdf64c67e5c5983c0f1f190bab6
SHA512 16b87ebcdb7d23720a16fabb27cb28b7b9f13fb2e26e5842644d07ed40dc34ec440cd6bbf5b19a1f264b2810ace509ef2aa60be5f163f9bf5398ccc38590ae4c

memory/1136-64-0x00007FFDC2450000-0x00007FFDC2525000-memory.dmp

memory/1136-66-0x0000023312100000-0x0000023312107000-memory.dmp

memory/1136-69-0x00007FFDC2450000-0x00007FFDC2525000-memory.dmp

C:\Users\Admin\AppData\Local\bkdi\SystemPropertiesProtection.exe

MD5 26640d2d4fa912fc9a354ef6cfe500ff
SHA1 a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256 a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA512 26162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc

C:\Users\Admin\AppData\Local\bkdi\SYSDM.CPL

MD5 6f2e519200543f1da0aec2371fccd7c4
SHA1 c463608ab6f6fbba6edfe9040037651282b1e4a8
SHA256 f4658446fc238e4fa1bc740287ee5bab25035e00f60c027029d9fd060d53bf40
SHA512 8105a181d79df8fac16a2b2dc734f1ec0015bafdf488db229b1f13a5f1f7b5c653d557165abb555c32f05771de281d981b0af33331be2e127188894cbddafd90

memory/1508-80-0x0000026343F30000-0x0000026343F37000-memory.dmp

memory/1508-85-0x00007FFDC2450000-0x00007FFDC2525000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wdush.lnk

MD5 d4d52807eaa3fb768472736871747537
SHA1 7fd876f4421cc8e7aa3f80ffbd8ce304704c496e
SHA256 313912c765533400afc64b0ccd7750ef28d6dc68ec948dd8041a18140478651d
SHA512 17964e68ac55527df2c33a86188e9ce908d379624499b04abbe70bfbaf0c4c135c4c099ec9e78426da5edc26bc79e1f4a29f7a761c7af1dee8320abb47a5e203

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\rBvMcKQ\dwmapi.dll

MD5 98dd877f454ff7b4ad0cbd50464ba354
SHA1 c4f49bf8ddf5179e7d650d78b5b1f9d9d50eec42
SHA256 10e751e35a5505418729ebc4143b05c1c947494a9d5c79d5353b585eeba179a2
SHA512 9024715f684cf20cd2421fb10484d660735459c1070e48e72ee0fa6377577c15903d91c7f236e13d4b626026cf50e050297480ca8f1fb5a110091f4d6ed28cf4