Malware Analysis Report

2024-11-13 16:41

Sample ID 240126-rvw38ahber
Target 779ba17cb5ed3bb94e1d07aa171986a5
SHA256 be9b2a400439006f513f0980901a98e17cc45eb12faab2c4bf9dbb87615049fb
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

be9b2a400439006f513f0980901a98e17cc45eb12faab2c4bf9dbb87615049fb

Threat Level: Known bad

The file 779ba17cb5ed3bb94e1d07aa171986a5 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Loads dropped DLL

Executes dropped EXE

Checks whether UAC is enabled

Adds Run key to start application

Unsigned PE

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of UnmapMainImage

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-26 14:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-26 14:31

Reported

2024-01-26 14:34

Platform

win7-20231215-en

Max time kernel

150s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\779ba17cb5ed3bb94e1d07aa171986a5.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\EXL\rdpshell.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\peYqjInqz\dvdupgrd.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\E5zj5M2Vi\msinfo32.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bsfvntd = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\PRINTE~1\\3J0NIV~1\\dvdupgrd.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\EXL\rdpshell.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\peYqjInqz\dvdupgrd.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\E5zj5M2Vi\msinfo32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1144 wrote to memory of 2608 N/A N/A C:\Windows\system32\rdpshell.exe
PID 1144 wrote to memory of 2608 N/A N/A C:\Windows\system32\rdpshell.exe
PID 1144 wrote to memory of 2608 N/A N/A C:\Windows\system32\rdpshell.exe
PID 1144 wrote to memory of 2984 N/A N/A C:\Users\Admin\AppData\Local\EXL\rdpshell.exe
PID 1144 wrote to memory of 2984 N/A N/A C:\Users\Admin\AppData\Local\EXL\rdpshell.exe
PID 1144 wrote to memory of 2984 N/A N/A C:\Users\Admin\AppData\Local\EXL\rdpshell.exe
PID 1144 wrote to memory of 2536 N/A N/A C:\Windows\system32\dvdupgrd.exe
PID 1144 wrote to memory of 2536 N/A N/A C:\Windows\system32\dvdupgrd.exe
PID 1144 wrote to memory of 2536 N/A N/A C:\Windows\system32\dvdupgrd.exe
PID 1144 wrote to memory of 2780 N/A N/A C:\Users\Admin\AppData\Local\peYqjInqz\dvdupgrd.exe
PID 1144 wrote to memory of 2780 N/A N/A C:\Users\Admin\AppData\Local\peYqjInqz\dvdupgrd.exe
PID 1144 wrote to memory of 2780 N/A N/A C:\Users\Admin\AppData\Local\peYqjInqz\dvdupgrd.exe
PID 1144 wrote to memory of 1800 N/A N/A C:\Windows\system32\msinfo32.exe
PID 1144 wrote to memory of 1800 N/A N/A C:\Windows\system32\msinfo32.exe
PID 1144 wrote to memory of 1800 N/A N/A C:\Windows\system32\msinfo32.exe
PID 1144 wrote to memory of 2020 N/A N/A C:\Users\Admin\AppData\Local\E5zj5M2Vi\msinfo32.exe
PID 1144 wrote to memory of 2020 N/A N/A C:\Users\Admin\AppData\Local\E5zj5M2Vi\msinfo32.exe
PID 1144 wrote to memory of 2020 N/A N/A C:\Users\Admin\AppData\Local\E5zj5M2Vi\msinfo32.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\779ba17cb5ed3bb94e1d07aa171986a5.dll,#1

C:\Users\Admin\AppData\Local\EXL\rdpshell.exe

C:\Users\Admin\AppData\Local\EXL\rdpshell.exe

C:\Windows\system32\rdpshell.exe

C:\Windows\system32\rdpshell.exe

C:\Users\Admin\AppData\Local\peYqjInqz\dvdupgrd.exe

C:\Users\Admin\AppData\Local\peYqjInqz\dvdupgrd.exe

C:\Windows\system32\dvdupgrd.exe

C:\Windows\system32\dvdupgrd.exe

C:\Windows\system32\msinfo32.exe

C:\Windows\system32\msinfo32.exe

C:\Users\Admin\AppData\Local\E5zj5M2Vi\msinfo32.exe

C:\Users\Admin\AppData\Local\E5zj5M2Vi\msinfo32.exe

Network

N/A

Files

memory/3052-0-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3052-1-0x0000000000110000-0x0000000000117000-memory.dmp

memory/1144-4-0x0000000076EF6000-0x0000000076EF7000-memory.dmp

memory/1144-11-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-17-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-23-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-32-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-38-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-39-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-40-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-47-0x0000000002DD0000-0x0000000002DD7000-memory.dmp

memory/1144-49-0x0000000077001000-0x0000000077002000-memory.dmp

memory/1144-50-0x0000000077160000-0x0000000077162000-memory.dmp

memory/1144-48-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-37-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-36-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-59-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-35-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-34-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-33-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-31-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-30-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-29-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-65-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-28-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-67-0x0000000140000000-0x000000014023E000-memory.dmp

\Users\Admin\AppData\Local\EXL\WINSTA.dll

MD5 9c6e7cb84e27e81c56acfddc4f163eb8
SHA1 edaff824c127863cc40cc9235ac4dc94d03d8afa
SHA256 f17a66e37c1fee847c7f6121f6f7c68d0607c755a69cfbcf47b8f028c58a34f0
SHA512 2fcaf90a8438bd559ffc1aad25031d82519577ce8be3b05f171ed7ba7d83b86406c21c6d3e7a3be672d5ee2c6164c19b44d2c9376b20ad9dd11a44b797fcbb3f

C:\Users\Admin\AppData\Local\EXL\WINSTA.dll

MD5 159602201cb79dd1cbedbd6480bdad04
SHA1 fd964277b61b9c53a2cf24f307678ab1797749b4
SHA256 cdd66867942d9cb327cd69133bcf8554a58d1474e9891aa29dc6424b2ff82b83
SHA512 e0eccc0e01541044c229050066685ad738f54238e3d8b4549ab4a9587fa4c5679e2ff83e3713b3fecc13947171bac2a78b2bb350a2b935f13a666377698b07fc

memory/2984-78-0x0000000140000000-0x0000000140240000-memory.dmp

memory/2984-82-0x0000000140000000-0x0000000140240000-memory.dmp

memory/2984-77-0x0000000000100000-0x0000000000107000-memory.dmp

C:\Users\Admin\AppData\Local\EXL\rdpshell.exe

MD5 5c206ddc0521053cda17c3d360641036
SHA1 4693a26392f3c0551824ef8c81ada79163843453
SHA256 07bde3f378893c1530a8625329f6ebc06fe84813ee27027ba6e58ddb014a17da
SHA512 31a29f60bb5de673363ae1754a06466f72864d842598f52a09b12231a465f636fc8f4725bb2649bf9c3c84e2feafcbb78103fc01d04a3adc90d2a7d27dce6185

\Users\Admin\AppData\Local\EXL\rdpshell.exe

MD5 4494238e9f1df55599d3df0b2cca987f
SHA1 030cc7b7db7ef2484328b2adbff37d33f7be7f26
SHA256 c178f66d98e76e0c93cea5728290fce30c8b71199941cb6bcc54f295c1d707db
SHA512 e15b6006a2695e30b1f0a3b4a4120a149bf0535028695b6cd175af5041585d2204ccc9fc85d7ef76246dc1375a340e8314461e1558be8d33ddc60b15f2edec6c

C:\Users\Admin\AppData\Local\EXL\rdpshell.exe

MD5 0fa37a003e8a771cce5334af2f474a90
SHA1 3c2347f5a06377dc64716b84e821ed67b52a2832
SHA256 7f16cef249c84939cc55076987a537ee6f01cba266318b7df8f580c28552c7c7
SHA512 420b76d295b2444dbdc98739971b03e7a64c8a26ff8258379c79effc9cf34eb928d5339e029440844307dcab24974d3d3dfa0130d32490b0d1ac6bc6f7f35825

memory/1144-27-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-26-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-25-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-24-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-22-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-21-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-20-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-19-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-18-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-16-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-15-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-14-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-13-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-12-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-10-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-9-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3052-8-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-7-0x0000000140000000-0x000000014023E000-memory.dmp

memory/1144-5-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

\Users\Admin\AppData\Local\peYqjInqz\dvdupgrd.exe

MD5 75a9b4172eac01d9648c6d2133af952f
SHA1 63c7e1af762d2b584e9cc841e8b0100f2a482b81
SHA256 18f9f520c7157023b0e7dfe7433a63c4dedd47b04d24aac4038b795893050736
SHA512 5a7a2c7f184efd9c84256a1a0a5e7aeb95432d63a567196be54e7a9437a5ada9b922983c5fc0cafb16eab4493665d8e56e2f646f9f6a2d6179986925ffcdf769

\Users\Admin\AppData\Local\peYqjInqz\VERSION.dll

MD5 7a337dd6b780c254035fc675570f6af2
SHA1 0e58036a60a92301e402225bc68e404068c284e7
SHA256 79ce7eda34ddb8c0d90b1bc66ddaa1e01ced006b05cf35f476bd55e4085ebc7b
SHA512 83501507100a7da33f4e0b0b6ed1e58eebf41671e92d95373fe4b7b26a7b288f755c58f86300bf0bb88d2d3fa6ae13548653fcd9ed54f5f6094191a9b43e0cea

memory/2780-97-0x0000000140000000-0x000000014023F000-memory.dmp

C:\Users\Admin\AppData\Local\peYqjInqz\VERSION.dll

MD5 15f8d5ee1d03ce0374aca1200b6e8ede
SHA1 ecad9e64dedb0786015ec620c5bf1823ce651695
SHA256 b3a902e4313044f63e5684f38b65eb9edf9383f209d676442c47c2c252568b31
SHA512 adc45f4817991ec3c9b6a5bfa9290b0b9e7d6f38f419ce277f2e304c553912b98e46bb3a3a3e95bfe2861b3020b64721062649f8d19723a7c6092bd42907ec95

\Users\Admin\AppData\Local\E5zj5M2Vi\MFC42u.dll

MD5 09216203f3c8a243702af379faa74ffd
SHA1 92640b2fb56295c10a17f09c6a2a6011d5d41ad4
SHA256 0d38067472d95304a1a7239c690fd767e444e9fa9324181b3121d9343a15a235
SHA512 7797229002ae2d57d5ecc160413c1a87b1587a11ac81395a19020933e43b46e85d3eead3ee74f023b44e110f20b704cc7a53abc8e7a354c8c9f97eb4a112bf08

memory/2020-116-0x0000000000180000-0x0000000000187000-memory.dmp

C:\Users\Admin\AppData\Local\E5zj5M2Vi\MFC42u.dll

MD5 05b48dbe3f176ee5d4f1d64395066b66
SHA1 c7ec00aa2db6a0880dbf18fabdb22145e00868df
SHA256 baa2cd98e304b2088e5ac24a897a311c0f1ebb395d5b1b48ffac6f330bda362d
SHA512 0b5e092c35934f631116bc3e2e5f95470d868bb5d050f61abbcd6f10db6aa53e4d382d9bf41f427a9c1622c18f255c44b434cdcaf2f9e85631b4bc41628f542e

C:\Users\Admin\AppData\Local\E5zj5M2Vi\msinfo32.exe

MD5 e6b3e9495d510a19beb13f720413d47e
SHA1 8162d0045e6af19a36f8f06b7e8db0483b7ebda3
SHA256 089578bd7dd6ae2f54ff8406295a1a38e5e407324988315ad1709653e5a2f6e5
SHA512 61de3afc99f18ba38212f8c5fc13169d98cc3ccfe221eed5532addeccb0715a792b12822df84e5db68c3fd90f5d293b0c55cf385ddb61aeaa3784dbe6cbf8f87

\Users\Admin\AppData\Local\E5zj5M2Vi\msinfo32.exe

MD5 805b2cd34da070f072bf48c92784a84d
SHA1 d2b431f91ebab075e451d8ba1bf913ea602b202b
SHA256 566a2ebc8e9f1085e465269aed8c48abb210ad5a225858e2f01743d2873b8458
SHA512 c15b0a8dd55b29510ae29a72fa18e1da64a28c731f526cc7e9b7b8fec5aaa7efb21b3050790c7b6b5f0ed0f739085182e7c3e5ab3b86ccf940096c8abf944e43

C:\Users\Admin\AppData\Local\E5zj5M2Vi\msinfo32.exe

MD5 96f74905acde8ded3eefa5306e5410b5
SHA1 a175c0de58f70dee6a78d9fcca8eb2a4f9fde9a4
SHA256 c1ca4c31c1ddf79ab117517fe79bbc460f3915b3b0d402b2db3349ed6b5675f4
SHA512 f4001b02b5fd67fdd920fe70b5bd97e500911d0d4473430fd1444c3d7ddd2ba88f385ae4aad63fdb701be15e087dfdd0bc0c15529ff948db0adb1cc49e6a957e

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\buLg\msinfo32.exe

MD5 6b970c36453b0eb7737acb22e1f3827a
SHA1 b1329b88bf4a3c5300fd6096b57d185f1c976a6a
SHA256 1a644db37d0bdc510dbaa7b1bf8187c37afb1ae32f2a3d9ab34f8c8a47a9ac8c
SHA512 c73dd58c3c6b5e377967a0f43de9778c01e0ca8b66ea91372f5fab5666ddb539490511c2a937d75e12bbc805553ac534d77fac15e3e63826ebf9a372fdd74a15

memory/1144-137-0x0000000076EF6000-0x0000000076EF7000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Cuhrqknkppepky.lnk

MD5 0a9b9004d26b3d3dd4945aa6e58158f9
SHA1 cc16832f2026e5fa0634ede61a2a12d2d5624800
SHA256 440585abf93a615a8d301232e0119616a7d9e3faccd3fe8439ed76ef535bfb60
SHA512 b5ecc57f81146c95462446460f599ae02e8cfa65495520258eea5ac102baa6822fea6ca3cdd08649f51e42c3cf1f9bc2fec3195ab67193404ce46b419d165912

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Collab\lfVA0M4PqW3\WINSTA.dll

MD5 5c44808fdaf625c5639d58ef871e5689
SHA1 ef1519c2b604b6e2d6e0e2e5e866b43888b65fdb
SHA256 aecbce96791bf6cafa3eab7c32fcca9fa939234ebbe145da9fe4fe196ecc7052
SHA512 52c6b864b4fa913a0e12e43244bfe1e0c8a4085f9bb61d005edb8e200e1fc8458c26776576edc5d07b81ce159f004cc49bc83180aa7303177d920f37099f33e5

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\3J0NivCBv6\VERSION.dll

MD5 1287c9cdfdfcc292083387f303faf138
SHA1 fcc1ee81a5de44b91851a589db7a85e18376ecaf
SHA256 aa60aff86b272c54779a73251304b8f99da61e30e1a71feb09010192dba34407
SHA512 89ecf609c1b840da2c0423ada48eefbdfd4e89e44d7b8ee52739f340d77917ead8a6a09242fb5bbbc06d7ffb1ea6f0bd2b9d4c4acd7bc3b91d41a25051efcf3c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\buLg\MFC42u.dll

MD5 0f7d8978095005b83df049169a48b500
SHA1 3660de98a242e4582520b2d5a8a146be398bfffc
SHA256 df1b9402eeb4e777fc92ffe28ce51356e3fa91851dde437c285ef4da94bc82c5
SHA512 b2762a3830ca1c879a1afb6c2e0cf508660c6493209f1b8cef45c984d2713e02761d1e5fb629bab3ff2645653b18f21f6d4fecfa10a2e62d2b0c027a9768d113

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-26 14:31

Reported

2024-01-26 14:34

Platform

win10v2004-20231222-en

Max time kernel

149s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\779ba17cb5ed3bb94e1d07aa171986a5.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mbfbagbrjs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\mcJSBCfEbv\\SystemPropertiesComputerName.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\fyEfBO9cR\rdpinput.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\5kcC1y\SystemPropertiesComputerName.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\CvGX89V\FXSCOVER.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3628 wrote to memory of 4004 N/A N/A C:\Windows\system32\rdpinput.exe
PID 3628 wrote to memory of 4004 N/A N/A C:\Windows\system32\rdpinput.exe
PID 3628 wrote to memory of 4624 N/A N/A C:\Users\Admin\AppData\Local\fyEfBO9cR\rdpinput.exe
PID 3628 wrote to memory of 4624 N/A N/A C:\Users\Admin\AppData\Local\fyEfBO9cR\rdpinput.exe
PID 3628 wrote to memory of 844 N/A N/A C:\Windows\system32\SystemPropertiesComputerName.exe
PID 3628 wrote to memory of 844 N/A N/A C:\Windows\system32\SystemPropertiesComputerName.exe
PID 3628 wrote to memory of 3048 N/A N/A C:\Users\Admin\AppData\Local\5kcC1y\SystemPropertiesComputerName.exe
PID 3628 wrote to memory of 3048 N/A N/A C:\Users\Admin\AppData\Local\5kcC1y\SystemPropertiesComputerName.exe
PID 3628 wrote to memory of 4656 N/A N/A C:\Windows\system32\FXSCOVER.exe
PID 3628 wrote to memory of 4656 N/A N/A C:\Windows\system32\FXSCOVER.exe
PID 3628 wrote to memory of 2544 N/A N/A C:\Users\Admin\AppData\Local\CvGX89V\FXSCOVER.exe
PID 3628 wrote to memory of 2544 N/A N/A C:\Users\Admin\AppData\Local\CvGX89V\FXSCOVER.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\779ba17cb5ed3bb94e1d07aa171986a5.dll,#1

C:\Windows\system32\rdpinput.exe

C:\Windows\system32\rdpinput.exe

C:\Windows\system32\SystemPropertiesComputerName.exe

C:\Windows\system32\SystemPropertiesComputerName.exe

C:\Windows\system32\FXSCOVER.exe

C:\Windows\system32\FXSCOVER.exe

C:\Users\Admin\AppData\Local\5kcC1y\SystemPropertiesComputerName.exe

C:\Users\Admin\AppData\Local\5kcC1y\SystemPropertiesComputerName.exe

C:\Users\Admin\AppData\Local\fyEfBO9cR\rdpinput.exe

C:\Users\Admin\AppData\Local\fyEfBO9cR\rdpinput.exe

C:\Users\Admin\AppData\Local\CvGX89V\FXSCOVER.exe

C:\Users\Admin\AppData\Local\CvGX89V\FXSCOVER.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/2920-1-0x0000000140000000-0x000000014023E000-memory.dmp

memory/2920-4-0x000001A349320000-0x000001A349327000-memory.dmp

memory/2920-0-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-5-0x0000000002B00000-0x0000000002B01000-memory.dmp

memory/2920-8-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-7-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-10-0x00007FFD9FD1A000-0x00007FFD9FD1B000-memory.dmp

memory/3628-11-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-12-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-14-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-19-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-22-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-26-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-27-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-30-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-31-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-32-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-34-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-35-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-36-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-37-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-33-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-38-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-41-0x0000000000D50000-0x0000000000D57000-memory.dmp

memory/3628-42-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-40-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-49-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-39-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-29-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-28-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-25-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-24-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-23-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-21-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-20-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-17-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-18-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-16-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-15-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-50-0x00007FFDA1440000-0x00007FFDA1450000-memory.dmp

memory/3628-59-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-61-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-13-0x0000000140000000-0x000000014023E000-memory.dmp

memory/3628-9-0x0000000140000000-0x000000014023E000-memory.dmp

C:\Users\Admin\AppData\Local\fyEfBO9cR\rdpinput.exe

MD5 9fb7dfdb15ae38a9fe3cd14b4ad2917b
SHA1 c5efbe902bfe7fbd7d5448681ff1d512516ebe3c
SHA256 f4b0fb857862ff143b8fba3f44f01bcb95392c85b1c9b0abda505821a57f4c2c
SHA512 6d691979cfd239fac25cd00d9a998400e313e8631564495e84e086cb8ce3b5ca29a1bc4ff347f23c796ab4a2ebe7b1e0ed122f0148a306563199c7cdaf321829

memory/4624-73-0x00000252C9990000-0x00000252C9997000-memory.dmp

memory/4624-77-0x0000000140000000-0x0000000140240000-memory.dmp

memory/4624-70-0x0000000140000000-0x0000000140240000-memory.dmp

C:\Users\Admin\AppData\Local\fyEfBO9cR\rdpinput.exe

MD5 bd99eeca92869f9a3084d689f335c734
SHA1 a2839f6038ea50a4456cd5c2a3ea003e7b77688c
SHA256 39bfb2214efeed47f4f5e50e6dff05541e29caeb27966520bdadd52c3d5e7143
SHA512 355433c3bbbaa3bcb849633d45713d8a7ac6f87a025732fbe83e259ec3a0cb4eabb18239df26609453f9fc6764c7276c5d0472f11cf12d15ef806aa7594d090e

memory/4624-71-0x0000000140000000-0x0000000140240000-memory.dmp

C:\Users\Admin\AppData\Local\fyEfBO9cR\WINSTA.dll

MD5 e8ac224d0dd1cb202e1ce850765b0965
SHA1 b9ecfb2fb96e6d4933049813b0f9e8bbd75e7c33
SHA256 cecd041061f80a06b689a08ae45a78a6504148e8e7f47914657c8dffc1797bb0
SHA512 121526c6e833eb93dbfdc979b25028268f994d9d9a41fe576ad7a39450d0a0587bb503a4d85f5d29e048e19840861c959fba7d55b717524ab65207af60131160

C:\Users\Admin\AppData\Local\5kcC1y\SYSDM.CPL

MD5 b828b9327cc57e4aaf82f919b804f7de
SHA1 ce3fcf0a6c08029bc919f1cd794d100a82b1cdc9
SHA256 b18c656d611ab58537305bd13a0bc7ed030e298f2c5a6e9a90cdfe059aa936af
SHA512 b791a0602a451f98672dda3cc72c8397e5ed411f3c0226c9ac3523eb159bccaee97430afbc37c032eaf87ae9351e73ed2bf0daabb75678b9328bec0bff6ca5a4

memory/3048-89-0x0000000140000000-0x000000014023F000-memory.dmp

memory/3048-88-0x0000000140000000-0x000000014023F000-memory.dmp

memory/3048-95-0x0000000140000000-0x000000014023F000-memory.dmp

memory/3048-90-0x0000020587F80000-0x0000020587F87000-memory.dmp

C:\Users\Admin\AppData\Local\5kcC1y\SystemPropertiesComputerName.exe

MD5 6711765f323289f5008a6a2a04b6f264
SHA1 d8116fdf73608b4b254ad83c74f2232584d24144
SHA256 bd3a97327326e2245938ec6099f20059b446ff0fe1c10b9317d15d1a1dd5331e
SHA512 438abd282d9d1c0e7e5db2ce027ff9522c3980278b32b2eae09c595884a8dcbfd5178bc5926b1d15f03174303382e13f5d5ecab9a5d8e31fc07ef39e66c012e8

C:\Users\Admin\AppData\Local\5kcC1y\SYSDM.CPL

MD5 98709fa8e58635ac4ded425d9386d86d
SHA1 0860e8dd30c150aa0143ff0853c1ef7dd44343f9
SHA256 a275dc59b9b0d487379166f7a6a48f884c5ba1969b2ea08b9f71de2a11f6165d
SHA512 55e243a0f96224a45e64dc6eced8586579f5b98b449ffc9d285a4ea6e99e737b5e3e78f5baa8e9f69cd566c4a24e08a4542f50b3984a1c1842f1c2d1813bb753

C:\Users\Admin\AppData\Local\fyEfBO9cR\WINSTA.dll

MD5 ebb5f0d6faec9c94981bebad96fcb5ea
SHA1 a0b6962bac724922acbb12bd67f1affc08bfb4f1
SHA256 c2af4805346b14b6f9c12364ea38345ba728dace585cc85026ebe7cd38f823ec
SHA512 48102691cd1673582be9a804653fe891b4f687b3f9473d2076d5221feca46e32c1657fe7970e47530e13c217f0ca9e2809a3041d9bdf71a6f6fc9349970b2b19

C:\Users\Admin\AppData\Local\CvGX89V\FXSCOVER.exe

MD5 71fabda854453b29722b0b8e1c6499d8
SHA1 ee0364e9f923c41aa2d303c39df5fbeaee7bb198
SHA256 c4bc06478eb59c4dbdb6ec2b5f583595b070ede423e5313337d4409ac40b5c19
SHA512 e5c485b31b7141587841eda6ecbe317ff8f6f62291036401eaab15c620baf93fd7bda137ca194eafde5de5eb9fed20f27bb0b3700d54b2bfcbd3d420fd3f148c

C:\Users\Admin\AppData\Local\CvGX89V\MFC42u.dll

MD5 e8d49534b90f6a525ed02636f3acf536
SHA1 945901dd6674f58c3149e5c216e1f38054982d74
SHA256 76f97124851efa940f9c7ec141e8804ee704b00503c6bfc2118b046a69266c42
SHA512 ad9e8e643bb5879608b56fbb554abb1381522fe63263cf47eba29853050f546d563739fe0e4353eeadb3f64bfeabff1b4b3e7cbaed1fc003cca08ba55fe5d0fd

C:\Users\Admin\AppData\Local\CvGX89V\MFC42u.dll

MD5 f213dbae3c43ef5443e591fc0070dc03
SHA1 bb0fa97b9ed5e9e3190da17a5aee584e23b11a50
SHA256 924fdeeaec56007031f720f87e4d1031f10097efcb178ab0922fb3745cdf6f00
SHA512 033b3da367b7050907785d8e58bf62ffd472eeee4f22a16c5465203745db0d5a2b32c2a25514b851610c50f1370d96bd1cdcadf680559700e29512fa92d0c4c1

memory/2544-109-0x00000254427C0000-0x00000254427C7000-memory.dmp

memory/2544-113-0x0000000140000000-0x0000000140245000-memory.dmp

memory/2544-107-0x0000000140000000-0x0000000140245000-memory.dmp

C:\Users\Admin\AppData\Local\CvGX89V\FXSCOVER.exe

MD5 979f3680b37d31380aa93c2d0268c7f4
SHA1 3669d896f70a22942ef8eb94f20decbd10897893
SHA256 852c6104b621e755c7638ccf5d357f41142f47221382c380ffd3b91882d64808
SHA512 013c430b35fb51bc461b5507a2aae6f135cec424e0c507e9ba2904595d7cd8f05a43df2eb4d09e8376253799814e5019fb1512642f7943da42a438cd774fadba

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wdush.lnk

MD5 0d96c6fbaf821e534f898eded76ad57e
SHA1 7692c8a2e70e764cb3160c483032cd10ec72fff3
SHA256 5580dd9aeac75e2d6c5958d8b0b197286dcd2b329d48ce09b1635d40ea896cf8
SHA512 5dca6dda7a11ea95df5a4476e167c25d3fc815f5f2213398028079ce7e9b5b60c4609fe04dfe90e29f27ebfd82a6676f1289381c4dfa6d67d91f05a722c15a06

C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\NativeCache\ZQBTZCpNDH7\WINSTA.dll

MD5 07215a8ad602c7c6d229eba9dbfdd5a3
SHA1 a32adbb46778080aa76278b0b4418c6937cddd14
SHA256 ef824b45c3d8ea684ed2ec08d2d0076eeedc7062bd2afd82b38b27c52a2358d2
SHA512 3f08daf276d4c5ccf40f4f06e658343ef2f899637cc6c4215fe2532a992c09c992a156b22fec1b2773b12da3169def3c2fa17b8fdc09b60f9dab85e281317cbc

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\mcJSBCfEbv\SYSDM.CPL

MD5 5f5eccc8dd887d6ca400c496810470a1
SHA1 cc966825acfbed6e7799f0f8995b9e58b1f322fe
SHA256 ff72417f278a7028c812013cddd4ddf6a75abaf7c5169f548a0f4a049321e026
SHA512 c49c4b3774aa4fc5695a95a165a9dd4beb47591a0eb23f5ff1f99ba6cb6f777495cc3b2bd2ba2287baaa4f76b25fbeaa5e4c83c48967a2113ec96cf70a6681ca

C:\Users\Admin\AppData\Roaming\Adobe\6Nixs\MFC42u.dll

MD5 9c77ecd87759126614a82a7fc961b4b4
SHA1 c294e4f30d244b57e8fe4ae0d3bced1442024609
SHA256 c11f6fdae7c4f9b65a59650006f38c1fb20d9197ac8d6cf800891dd6fda9d44a
SHA512 d25370ee899926fd96701ceb4333ad6e2eab57c4e345c64693017eb748508eb1b197774670205c8c965c7178aebb94164757e3fcc022985fd805db2930e88644