Malware Analysis Report

2024-11-13 16:42

Sample ID 240126-baafqaahg9
Target 75f65720fe58821d96cea7f4f1f6f530
SHA256 dc652ba2912e47491ce16ba0da31998a4f7f8e30dc968203b5ed070fcebbf887
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dc652ba2912e47491ce16ba0da31998a4f7f8e30dc968203b5ed070fcebbf887

Threat Level: Known bad

The file 75f65720fe58821d96cea7f4f1f6f530 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-26 00:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-26 00:55

Reported

2024-01-26 00:58

Platform

win7-20231215-en

Max time kernel

150s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\75f65720fe58821d96cea7f4f1f6f530.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\jvzgmK\rdpclip.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Zac\ComputerDefaults.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\9CUd\VaultSysUi.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zqonzshwxyr = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\PRINTE~1\\z3cd\\COMPUT~1.EXE" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\jvzgmK\rdpclip.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Zac\ComputerDefaults.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\9CUd\VaultSysUi.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1228 wrote to memory of 1248 N/A N/A C:\Windows\system32\rdpclip.exe
PID 1228 wrote to memory of 1248 N/A N/A C:\Windows\system32\rdpclip.exe
PID 1228 wrote to memory of 1248 N/A N/A C:\Windows\system32\rdpclip.exe
PID 1228 wrote to memory of 2224 N/A N/A C:\Users\Admin\AppData\Local\jvzgmK\rdpclip.exe
PID 1228 wrote to memory of 2224 N/A N/A C:\Users\Admin\AppData\Local\jvzgmK\rdpclip.exe
PID 1228 wrote to memory of 2224 N/A N/A C:\Users\Admin\AppData\Local\jvzgmK\rdpclip.exe
PID 1228 wrote to memory of 1732 N/A N/A C:\Windows\system32\ComputerDefaults.exe
PID 1228 wrote to memory of 1732 N/A N/A C:\Windows\system32\ComputerDefaults.exe
PID 1228 wrote to memory of 1732 N/A N/A C:\Windows\system32\ComputerDefaults.exe
PID 1228 wrote to memory of 1548 N/A N/A C:\Users\Admin\AppData\Local\Zac\ComputerDefaults.exe
PID 1228 wrote to memory of 1548 N/A N/A C:\Users\Admin\AppData\Local\Zac\ComputerDefaults.exe
PID 1228 wrote to memory of 1548 N/A N/A C:\Users\Admin\AppData\Local\Zac\ComputerDefaults.exe
PID 1228 wrote to memory of 2492 N/A N/A C:\Windows\system32\VaultSysUi.exe
PID 1228 wrote to memory of 2492 N/A N/A C:\Windows\system32\VaultSysUi.exe
PID 1228 wrote to memory of 2492 N/A N/A C:\Windows\system32\VaultSysUi.exe
PID 1228 wrote to memory of 2400 N/A N/A C:\Users\Admin\AppData\Local\9CUd\VaultSysUi.exe
PID 1228 wrote to memory of 2400 N/A N/A C:\Users\Admin\AppData\Local\9CUd\VaultSysUi.exe
PID 1228 wrote to memory of 2400 N/A N/A C:\Users\Admin\AppData\Local\9CUd\VaultSysUi.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\75f65720fe58821d96cea7f4f1f6f530.dll,#1

C:\Windows\system32\rdpclip.exe

C:\Windows\system32\rdpclip.exe

C:\Users\Admin\AppData\Local\jvzgmK\rdpclip.exe

C:\Users\Admin\AppData\Local\jvzgmK\rdpclip.exe

C:\Windows\system32\ComputerDefaults.exe

C:\Windows\system32\ComputerDefaults.exe

C:\Users\Admin\AppData\Local\Zac\ComputerDefaults.exe

C:\Users\Admin\AppData\Local\Zac\ComputerDefaults.exe

C:\Windows\system32\VaultSysUi.exe

C:\Windows\system32\VaultSysUi.exe

C:\Users\Admin\AppData\Local\9CUd\VaultSysUi.exe

C:\Users\Admin\AppData\Local\9CUd\VaultSysUi.exe

Network

N/A

Files

memory/2772-0-0x0000000000290000-0x0000000000297000-memory.dmp

memory/2772-1-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-4-0x0000000077176000-0x0000000077177000-memory.dmp

memory/1228-5-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

memory/1228-7-0x0000000140000000-0x000000014037E000-memory.dmp

memory/2772-8-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-9-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-10-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-11-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-12-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-13-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-14-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-15-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-16-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-17-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-18-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-19-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-20-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-21-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-22-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-23-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-24-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-25-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-26-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-27-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-30-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-29-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-28-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-32-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-31-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-35-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-34-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-33-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-47-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-46-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-45-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-44-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-43-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-42-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-41-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-40-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-39-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-38-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-37-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-36-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-65-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-64-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-63-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-62-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-61-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-60-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-59-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-58-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-57-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-56-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-55-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-54-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-53-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-52-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-51-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-50-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-49-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-48-0x0000000140000000-0x000000014037E000-memory.dmp

memory/1228-80-0x0000000002730000-0x0000000002737000-memory.dmp

\Users\Admin\AppData\Local\jvzgmK\rdpclip.exe

MD5 25d284eb2f12254c001afe9a82575a81
SHA1 cf131801fdd5ec92278f9e0ae62050e31c6670a5
SHA256 837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b
SHA512 7b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b

\Users\Admin\AppData\Local\jvzgmK\WTSAPI32.dll

MD5 8cb554e8036652806cc12d92e38bcf19
SHA1 c2dc370b87232ab731e9447441db5901f23f9bbc
SHA256 ac5c9fc33a4bee4f9a4e2d241024ca7284765c80ddac41530d325a72d926aa25
SHA512 4eae8de092a6f0f01192c09ca9284b53cfbbc84c3b1c31bc61226bb6f97ced510e18df938040e280761ca39ce1f70b6084917c213a85f571adc7b45fea176401

memory/2224-113-0x0000000000180000-0x0000000000187000-memory.dmp

C:\Users\Admin\AppData\Local\Zac\appwiz.cpl

MD5 1fb78a3cc71c83bcc85ab36f87be4321
SHA1 2ad7623204c0e1ae6c25382948e4b29f1c15ff5e
SHA256 8433f5deaa2536f5ba9c33b57b9ca50eaea03a3ea4aa1d02d302ee3daf6c8056
SHA512 f4d276f1809b2961177a374a0b6385a476ce6da41a661122ce1499f2ff19ca05d913d522578f7a01e1399432ef506a7b589db360b3e42a1f2203df47995c92d0

C:\Users\Admin\AppData\Local\Zac\ComputerDefaults.exe

MD5 86bd981f55341273753ac42ea200a81e
SHA1 14fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA256 40b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA512 49bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143

\Users\Admin\AppData\Local\Zac\appwiz.cpl

MD5 71f17a85abbc72bc87f3ef680c51eb3d
SHA1 b554444db3c1d8953579d1871c340b10a667ce9d
SHA256 be815dfa3d230f883d35207048d7f2623700c2df270a64543626fc1b64f263da
SHA512 19971a4fac2538c5bec3ae60699c9cb744863893085ef75339db207396459b676096eb20ae8742b861aad2e7d77f56d998687158e0f32ef66d2c089b8d106762

memory/1548-131-0x0000000000370000-0x0000000000377000-memory.dmp

\Users\Admin\AppData\Local\9CUd\VaultSysUi.exe

MD5 f40ef105d94350d36c799ee23f7fec0f
SHA1 ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256 eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512 f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1

\Users\Admin\AppData\Local\9CUd\credui.dll

MD5 a1a2918303b7006e00c031f4f69705ac
SHA1 9fd8b0d4d49620da1664aab5d32fc477328f2bf4
SHA256 62ba3222c310edf52ee23d59424ba5c036fe8fec115df844c65726f5d07b6ae2
SHA512 794ba8edbb8499984c7a2243ff0abc053f36df5564733a20ee6a3462621975a2f3afc685236cc5d5f1fcdbef29362d4d1b8efc5476aff0931060ff3e27508518

C:\Users\Admin\AppData\Local\9CUd\credui.dll

MD5 a12a864b1ab1be297ae245b45ca77d85
SHA1 efd7cae5e91f53cab259325219169a50fe793655
SHA256 5277bbf58b3208380062673c81249431d4d7628abfa35caa140560c3d80d0394
SHA512 32b1f95285175f58b5f86e0dcddaffc7b03385fc9319267792b7a9e370fa4ef727c4e8564938fb39f664e6ce66dd595308306e2280013354f54d7d22857258f7

memory/2400-154-0x00000000000E0000-0x00000000000E7000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

MD5 26101af389c944fa1e85d75b5130c27a
SHA1 a03a6a1b9716ac6e689f7a0de4121d3dc97f17df
SHA256 90293f5a19e07971705e0b57c9a5a21fdb3590ebf1e7132f31eabce379054d56
SHA512 5d3793a47422baeba9c0d09ef7dc6801ca2a724b1c0ca8d8d00163ae3828f053e7d8478665fc5e86a20624a798ed9dd41a3932293e7c4016d3d41c45c8e927a6

memory/1228-175-0x00000000774E0000-0x00000000774E2000-memory.dmp

memory/1228-176-0x0000000077381000-0x0000000077382000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\z3cd\appwiz.cpl

MD5 69bbd5b7143ab36334d117e538563464
SHA1 7487251acc0fa4ad4643d96d5cc13457b458b1e1
SHA256 de568870f52c78e34d35db8ff98bbe744d85801aca9be937862a5294c4b35f36
SHA512 3311107f1b86a6a4403d6629108c60da7bf3ef50bb8b6e08b5705a8c15d52bc63d2ac32a52cacbe3cd9f9953aa8b0732806e1f4f0a14a0d72301d6fec3544842

C:\Users\Admin\AppData\Roaming\Macromedia\WREL\credui.dll

MD5 6935049e89968874c453d1fe02bfcaee
SHA1 4bf50fc86e81851059eac8d4bd6898f4414dbce8
SHA256 978a20f4f06419ee58f4b2f8184dcfcff2a5f4d0dd2596f3af44d0ac698c3660
SHA512 8732788356a95666983b94900706b7fa43ead42cf8172ae5360935f8ec85afbbcf0e091ce34b8acbd405a9a7e5ea7d95cd66394017e0c42c149dbd91cb55cc30

memory/1228-193-0x0000000077176000-0x0000000077177000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-26 00:55

Reported

2024-01-26 00:58

Platform

win10v2004-20231222-en

Max time kernel

122s

Max time network

92s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\75f65720fe58821d96cea7f4f1f6f530.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mbfbagbrjs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\yUSLvNi\\wextract.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Txq\WMPDMC.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\CDXq33\phoneactivate.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\GEsNSdan2\wextract.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3652 wrote to memory of 4684 N/A N/A C:\Windows\system32\phoneactivate.exe
PID 3652 wrote to memory of 4684 N/A N/A C:\Windows\system32\phoneactivate.exe
PID 3652 wrote to memory of 4640 N/A N/A C:\Users\Admin\AppData\Local\CDXq33\phoneactivate.exe
PID 3652 wrote to memory of 4640 N/A N/A C:\Users\Admin\AppData\Local\CDXq33\phoneactivate.exe
PID 3652 wrote to memory of 3440 N/A N/A C:\Windows\system32\wextract.exe
PID 3652 wrote to memory of 3440 N/A N/A C:\Windows\system32\wextract.exe
PID 3652 wrote to memory of 1044 N/A N/A C:\Users\Admin\AppData\Local\GEsNSdan2\wextract.exe
PID 3652 wrote to memory of 1044 N/A N/A C:\Users\Admin\AppData\Local\GEsNSdan2\wextract.exe
PID 3652 wrote to memory of 4372 N/A N/A C:\Windows\system32\WMPDMC.exe
PID 3652 wrote to memory of 4372 N/A N/A C:\Windows\system32\WMPDMC.exe
PID 3652 wrote to memory of 1120 N/A N/A C:\Users\Admin\AppData\Local\Txq\WMPDMC.exe
PID 3652 wrote to memory of 1120 N/A N/A C:\Users\Admin\AppData\Local\Txq\WMPDMC.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\75f65720fe58821d96cea7f4f1f6f530.dll,#1

C:\Windows\system32\phoneactivate.exe

C:\Windows\system32\phoneactivate.exe

C:\Windows\system32\wextract.exe

C:\Windows\system32\wextract.exe

C:\Users\Admin\AppData\Local\Txq\WMPDMC.exe

C:\Users\Admin\AppData\Local\Txq\WMPDMC.exe

C:\Windows\system32\WMPDMC.exe

C:\Windows\system32\WMPDMC.exe

C:\Users\Admin\AppData\Local\GEsNSdan2\wextract.exe

C:\Users\Admin\AppData\Local\GEsNSdan2\wextract.exe

C:\Users\Admin\AppData\Local\CDXq33\phoneactivate.exe

C:\Users\Admin\AppData\Local\CDXq33\phoneactivate.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp

Files

memory/4900-1-0x0000000140000000-0x000000014037E000-memory.dmp

memory/4900-3-0x0000021814870000-0x0000021814877000-memory.dmp

memory/4900-0-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-5-0x0000000004B30000-0x0000000004B31000-memory.dmp

memory/3652-12-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-11-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-16-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-20-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-23-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-26-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-27-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-28-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-29-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-25-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-24-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-22-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-21-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-19-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-18-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-17-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-15-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-14-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-13-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-10-0x00007FF880C5A000-0x00007FF880C5B000-memory.dmp

memory/4900-8-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-7-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-9-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-31-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-32-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-35-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-39-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-43-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-44-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-42-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-45-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-46-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-49-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-51-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-52-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-54-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-57-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-59-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-61-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-64-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-66-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-65-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-62-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-63-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-60-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-74-0x0000000002EE0000-0x0000000002EE7000-memory.dmp

memory/3652-58-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-56-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-55-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-53-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-50-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-48-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-47-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-82-0x00007FF881A00000-0x00007FF881A10000-memory.dmp

memory/3652-41-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-40-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-38-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-37-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-36-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-34-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-33-0x0000000140000000-0x000000014037E000-memory.dmp

memory/3652-30-0x0000000140000000-0x000000014037E000-memory.dmp

C:\Users\Admin\AppData\Local\CDXq33\SLC.dll

MD5 e2422f9100ea03d12fdd5906c93483d9
SHA1 628e8de4f4f60d360b9e87a7dbdb767265d13d71
SHA256 d253a1e3c0cfa9919909e1bbb293bf94be6069f48ead2140afcccdea9143747e
SHA512 9de459b32638261056551e917c950012f1baf08aa967caf27b8d32f2d76e9aa9f9947103515b434f361073b3d5dcc2801a6cd1886cf37e85f2f6df0884a0a08a

C:\Users\Admin\AppData\Local\CDXq33\SLC.dll

MD5 f2c7c736a4837f8a0efc5491de91c3dc
SHA1 d54475c6e808106738a618d72f68ef258735cf57
SHA256 e95ed93d0280ac44d818501425932cbb365750830309f738a7a67652a779bf98
SHA512 28e872653ce4c0c7b77a8137f295a80f6d14504427219d525a186a50f80bff4aa93221c1249a4ce099874bab651ab0745ebbd3795aaad9149046b68ab667c125

memory/4640-105-0x00000293E7460000-0x00000293E7467000-memory.dmp

memory/4640-110-0x0000000140000000-0x000000014037F000-memory.dmp

C:\Users\Admin\AppData\Local\CDXq33\phoneactivate.exe

MD5 7ad504dc7701ee129aa1e33043183a20
SHA1 b6d8727b288459b97a0aeeea86efc21be2539698
SHA256 57918dfb236e21c0fd016467932976dbcdcf73947740ec6a017c635e93a61478
SHA512 9628ad1c5ef799e5f3eaa766b794bff12aed0e4af98cdc2aec0c5419a4844b9c0a44326594655cbb7e8f560db9b3b2ac6eb5d02e1c654337a55ec52b371e9cd8

memory/4640-103-0x0000000140000000-0x000000014037F000-memory.dmp

C:\Users\Admin\AppData\Local\GEsNSdan2\VERSION.dll

MD5 09e72bb11bfa628ce933b1594fe350a1
SHA1 dec397a57c51faf2dde475091013e83f7195c411
SHA256 047eebac18b182e01bb4c3d03956a0df7d1fee7281d8685d36eb7e5b223ac1d2
SHA512 b14bc3c8c06d3ccd2bd98251b5f849c97e0ec2a811f44d00a8153a0ee86f1e73feb4540acf631e413970fc31ca13ab26a87eafe5971fa5027a27f3796c7cab41

memory/1044-123-0x000001FBE5CF0000-0x000001FBE5CF7000-memory.dmp

memory/1044-122-0x0000000140000000-0x000000014037F000-memory.dmp

memory/1044-129-0x0000000140000000-0x000000014037F000-memory.dmp

C:\Users\Admin\AppData\Local\GEsNSdan2\wextract.exe

MD5 49bb0cbe45cdaa3f10a444164c991403
SHA1 44a8a0c1ac9e300fde4360859adb41309d1a9f2c
SHA256 9fda567a529cae072f1759ad570a048f3d837426f52fd29f15c700c0405384cd
SHA512 fe758a62875c52a862f4b6d82c1794502a587f531b7a4e57464ee13336ca3761d1754b921af65702444d70fc0c9a668019cb60bff079894fd9aba8b310db7b77

C:\Users\Admin\AppData\Local\Txq\dwmapi.dll

MD5 32cf9b369779ff090acd86648e81ccb4
SHA1 205fce7e77505fe44ffddec4c7668f7f852fcbd9
SHA256 c803f4abfea92b07bc078dff1b8039c72ae5245d5e22d8a547d8e025090d319f
SHA512 d0bc6efe840162153b69222bf8b35dfde2fc0a86799f58d65264311548c62a930dcba60b473e2d773176cb206aad778bedf413d0f472a29d7713957412d212f0

memory/1120-142-0x00000249139A0000-0x00000249139A7000-memory.dmp

memory/1120-148-0x0000000140000000-0x000000014037F000-memory.dmp

memory/1120-140-0x0000000140000000-0x000000014037F000-memory.dmp

C:\Users\Admin\AppData\Local\Txq\WMPDMC.exe

MD5 2c4519a48e4829d2ba784e8855707ade
SHA1 b86938d7a3e698a219b6af02097f1a954b8569cc
SHA256 385b79f361105d8a2ab16a3f5c6cc7567e8986afe7760eb6c4b54813845ec98a
SHA512 0b4ea483824a79dcab9cf6a15f56db2b334a1e34b1ffb7ad0f937c5b7a6b97fac9a9e2bdb178c72e289f998822a26106b11a14157c039af3d905884d8a75f682

C:\Users\Admin\AppData\Local\Txq\dwmapi.dll

MD5 51876ebf9f1939c3a72d31088522bb39
SHA1 fdceb970cc5e274832ad8322389e31ed2ceb79fd
SHA256 7eb113dca728acc8291722f4c706999e05dc089b27e75e94d1a8a2b98047e9d3
SHA512 28383fa3f04d00fd13c6c166fea4371d8219ae81cefc234e669b3660ecb63af6671bf4e21aea3517cbbdccbbd500ac1c29afc79c4dca0db94872c9a27187c9d4

C:\Users\Admin\AppData\Local\Txq\WMPDMC.exe

MD5 2b6457c9685bf3a1b3a6e2b1db6ec18f
SHA1 c56be9acf87ed424e1393e401765d502564d5acc
SHA256 bee63d44f7177d63203dca2e09f6fb88887f551a3e328a77f9caeb06c0158d0e
SHA512 17ddf9bcb8789fc2462c5a3fe287846602cff7944a084e6a31f2dfcc9fbcbddbb62e2dd528383f5f6e97cd03b736aaadef46a84c5dfab3cb74108ade76c80d5e

C:\Users\Admin\AppData\Local\GEsNSdan2\VERSION.dll

MD5 34ee9012b1540335fcb296f0df6c5e51
SHA1 429a90e55c707f98eb0f44f6fea8100d93f75300
SHA256 9a0499a7249516f19bdf7c77b24af55f68c1bf90fef9ab2aecf0c28465a628ff
SHA512 bf348923f605794415a394ea07da596b1057f53e290edec41b0ad3e279e13e2af456a0ef9acf2c6ec4814042092fef29b95f2fd10561468072b2b86940661784

C:\Users\Admin\AppData\Local\GEsNSdan2\wextract.exe

MD5 56e501e3e49cfde55eb1caabe6913e45
SHA1 ab2399cbf17dbee7b302bea49e40d4cee7caea76
SHA256 fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0
SHA512 2b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172

C:\Users\Admin\AppData\Local\CDXq33\phoneactivate.exe

MD5 32c31f06e0b68f349f68afdd08e45f3d
SHA1 e4b642f887e2c1d76b6b4777ade91e3cb3b9e27c
SHA256 cea83eb34233fed5ebeef8745c7c581a8adbefbcfc0e30e2d30a81000c821017
SHA512 fe61764b471465b164c9c2202ed349605117d57ceb0eca75acf8bda44e8744c115767ee0caed0b7feb70ba37b477d00805b3fdf0d0fa879dd4c8e3c1dc1c0d26

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wdush.lnk

MD5 c3262b8cc19249b9acb932c1235f9917
SHA1 b37c2e50c865d3c193eee7366dc37b6d9ac5ae25
SHA256 ff8e4c81bbc532cef2f2c940b19906c5e2338288766029fb3c4345f456d60d9e
SHA512 eb7a6638b440ec695a1efb08d74b75972dcb4f8139ca203d004d22a76fc79739fa09173fd25f45c53b9daa9bb379c328b9fa6362bf61e7c1e46c57227925da63

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\dfGgqEVRF\SLC.dll

MD5 765d6d164086e191f416f006271d6ccf
SHA1 c0a76e61189f94b6d053f5e1ced726e4fdcc6e79
SHA256 a0c583eb13d44e8675d4fbe1fd8d8aaf1a0cfe189012407c6a7161dc2b618b70
SHA512 45baf874bd4ce3077e5274c0959d6b96dddb10ebb7e66d505f08ed301f026a33ce285be9ad4967fa3ebc7b5dc85aac0efc734934c17e0cbf9519b4800481983b

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\yUSLvNi\VERSION.dll

MD5 ec6b20bbc60f060622d287f7cece84c2
SHA1 1abfcd185f4430538da1d034bf0bf10adfb54b59
SHA256 b6004765d5ad36e46f44a2134e216faac1c8fb5409be06b0f2aa8b7d98d7b49f
SHA512 f1b17e03265c9fda1475d92307974b77dbd8a3cc84456650f12a034a685d11e2ab40a76fe18f5d206a1d95ac7fd215a061b5f98b2045a23b88f7e780552464c6

C:\Users\Admin\AppData\Roaming\Sun\Java\Deployment\Y9UWN4\dwmapi.dll

MD5 e80189df97f304af3e8f878c0f9950c4
SHA1 f668ff7538d8a3a18a3ce63a1de04c21efd1f3d6
SHA256 0a63c6b7620c900dec2f6526d91945852b1a95dd710cf7579768f00b75da4280
SHA512 8b10de32cdf1b4517948d9301a8116761de833f41bf91935bd95677f89bf6cd6ca0b38cf9718bdc47c7955acabbb1ffff4d643baf7f95c4ace8ef3b6e17759b5