Malware Analysis Report

2024-11-13 16:41

Sample ID 240128-g6vpesehan
Target 7c6145fc88e55d7bac1db14f71a9f30c
SHA256 0d2b503372e4dc3d29a19e708d6309e96fc04a5845900e890b883a4af1e22bb2
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0d2b503372e4dc3d29a19e708d6309e96fc04a5845900e890b883a4af1e22bb2

Threat Level: Known bad

The file 7c6145fc88e55d7bac1db14f71a9f30c was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Suspicious use of UnmapMainImage

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-28 06:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-28 06:25

Reported

2024-01-28 06:28

Platform

win7-20231215-en

Max time kernel

150s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c6145fc88e55d7bac1db14f71a9f30c.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\spbVX\irftp.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\m14\SoundRecorder.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\Niubkzso = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FLASHP~1\\ASSETC~1\\WsWmLl\\mstsc.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\spbVX\irftp.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\m14\SoundRecorder.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1280 wrote to memory of 2832 N/A N/A C:\Windows\system32\irftp.exe
PID 1280 wrote to memory of 2832 N/A N/A C:\Windows\system32\irftp.exe
PID 1280 wrote to memory of 2832 N/A N/A C:\Windows\system32\irftp.exe
PID 1280 wrote to memory of 2592 N/A N/A C:\Users\Admin\AppData\Local\spbVX\irftp.exe
PID 1280 wrote to memory of 2592 N/A N/A C:\Users\Admin\AppData\Local\spbVX\irftp.exe
PID 1280 wrote to memory of 2592 N/A N/A C:\Users\Admin\AppData\Local\spbVX\irftp.exe
PID 1280 wrote to memory of 1688 N/A N/A C:\Windows\system32\mstsc.exe
PID 1280 wrote to memory of 1688 N/A N/A C:\Windows\system32\mstsc.exe
PID 1280 wrote to memory of 1688 N/A N/A C:\Windows\system32\mstsc.exe
PID 1280 wrote to memory of 2968 N/A N/A C:\Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe
PID 1280 wrote to memory of 2968 N/A N/A C:\Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe
PID 1280 wrote to memory of 2968 N/A N/A C:\Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe
PID 1280 wrote to memory of 1152 N/A N/A C:\Windows\system32\SoundRecorder.exe
PID 1280 wrote to memory of 1152 N/A N/A C:\Windows\system32\SoundRecorder.exe
PID 1280 wrote to memory of 1152 N/A N/A C:\Windows\system32\SoundRecorder.exe
PID 1280 wrote to memory of 524 N/A N/A C:\Users\Admin\AppData\Local\m14\SoundRecorder.exe
PID 1280 wrote to memory of 524 N/A N/A C:\Users\Admin\AppData\Local\m14\SoundRecorder.exe
PID 1280 wrote to memory of 524 N/A N/A C:\Users\Admin\AppData\Local\m14\SoundRecorder.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c6145fc88e55d7bac1db14f71a9f30c.dll,#1

C:\Windows\system32\irftp.exe

C:\Windows\system32\irftp.exe

C:\Users\Admin\AppData\Local\spbVX\irftp.exe

C:\Users\Admin\AppData\Local\spbVX\irftp.exe

C:\Windows\system32\mstsc.exe

C:\Windows\system32\mstsc.exe

C:\Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe

C:\Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe

C:\Windows\system32\SoundRecorder.exe

C:\Windows\system32\SoundRecorder.exe

C:\Users\Admin\AppData\Local\m14\SoundRecorder.exe

C:\Users\Admin\AppData\Local\m14\SoundRecorder.exe

Network

N/A

Files

memory/2480-1-0x0000000140000000-0x0000000140190000-memory.dmp

memory/2480-0-0x00000000000A0000-0x00000000000A7000-memory.dmp

memory/1280-4-0x0000000076D76000-0x0000000076D77000-memory.dmp

memory/1280-5-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

memory/1280-9-0x0000000140000000-0x0000000140190000-memory.dmp

memory/2480-8-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-13-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-14-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-12-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-15-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-19-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-20-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-21-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-27-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-26-0x0000000002AC0000-0x0000000002AC7000-memory.dmp

memory/1280-25-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-24-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-23-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-22-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-34-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-35-0x0000000076F81000-0x0000000076F82000-memory.dmp

memory/1280-17-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-18-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-36-0x00000000770E0000-0x00000000770E2000-memory.dmp

memory/1280-16-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-10-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-11-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-7-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-45-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-49-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1280-54-0x0000000140000000-0x0000000140190000-memory.dmp

C:\Users\Admin\AppData\Local\spbVX\MFC42u.dll

MD5 2ea89c90fd859c987f234efd38b5ae02
SHA1 fe32eb168aeebfde4866051129c8d400ccd34025
SHA256 400feafec263bc6f38041ce5003b7adc8274ebcd95ff253fde81883d8f775d8b
SHA512 d98531d35d4a1d3736cc65543840b5ab53fa57a35a2e7d8b6477bc84f0a6bb92f72c14778d6b0dd99bafdd5e3dc45f81fc36e4ab6078d1a27331580016a2e131

C:\Users\Admin\AppData\Local\spbVX\irftp.exe

MD5 0cae1fb725c56d260bfd6feba7ae9a75
SHA1 102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256 312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512 db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec

\Users\Admin\AppData\Local\spbVX\MFC42u.dll

MD5 9bee71871bd83a30c802e4bd738e575e
SHA1 f118f32a57530508546400437138fe56a42d0046
SHA256 d52acb80d3bc194da0be78c388f094d5e34d62bd74662552d14be910b25606c8
SHA512 b0048545526dfcb8a304a46c07033839ebf45806437147626bd8f17b922f99cf1733238236542c7d0ad6e7923bc94729c4c5d6b382f27b34d83478ec35fc0cc2

memory/2592-64-0x0000000140000000-0x0000000140197000-memory.dmp

memory/2592-63-0x00000000000F0000-0x00000000000F7000-memory.dmp

memory/2592-69-0x0000000140000000-0x0000000140197000-memory.dmp

\Users\Admin\AppData\Local\6ueMzQ4\mstsc.exe

MD5 50f739538ef014b2e7ec59431749d838
SHA1 b439762b8efe8cfb977e7374c11a7e4d8ed05eb3
SHA256 85c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3
SHA512 02e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8

C:\Users\Admin\AppData\Local\6ueMzQ4\Secur32.dll

MD5 f4eaebde9ae07a34ff4740cf770cbd2d
SHA1 9253135d739d105fe6f943668b8c8efcd24b2e4d
SHA256 0b82c5c6b4e642c9f1c59f148cf60d148082f71e75c81a1fbef02e6321f42e8f
SHA512 26a33aa9616eccb336ba7de1d32622af9a30c64a1f6770851bcd18c0ef77695a529ddb8973fde33c39d81c8219ba96ca57d3e5b8606d93fd88b4e4449b499470

memory/2968-81-0x0000000000120000-0x0000000000127000-memory.dmp

memory/2968-82-0x0000000140000000-0x0000000140191000-memory.dmp

memory/2968-85-0x0000000140000000-0x0000000140191000-memory.dmp

\Users\Admin\AppData\Local\m14\SoundRecorder.exe

MD5 47f0f526ad4982806c54b845b3289de1
SHA1 8420ea488a2e187fe1b7fcfb53040d10d5497236
SHA256 e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b
SHA512 4c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d

C:\Users\Admin\AppData\Local\m14\WINMM.dll

MD5 581595d5454aa244a38ce8eedb247583
SHA1 e2f02ad4a30263b5ce0d8a656002165eaf7e2b6a
SHA256 8454a51b2b1286fc682fa9918fac5f6faf49a2a54a7bc49a1bad1b9ce7439c16
SHA512 9c53d94b39fd6348f092777c164bd5641a4ce6d18ffbfd2fca0105189a6c2bd2b7b380f6e5ba8425c6657f1781003b368b15ded86cfb7e437a036aa8af5967e9

memory/524-99-0x0000000000100000-0x0000000000107000-memory.dmp

memory/524-100-0x0000000140000000-0x0000000140192000-memory.dmp

memory/524-105-0x0000000140000000-0x0000000140192000-memory.dmp

memory/1280-121-0x0000000076D76000-0x0000000076D77000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Efrsxj.lnk

MD5 04010e0b7931ec21c9b8aa7025231bd8
SHA1 8439a38100c36aeec223c203405a02d8e100efeb
SHA256 c8a41ba14c502f0ec3dc239f8c036cc87564a9043ec14a074781e8fafbd70795
SHA512 6d11cb597c8844a7462fd35cefd37e7ec1d83fabe3eec73559dcb37a1e630ff9512b429219f9dfb6b57a22d31c2b8e2033131ee46630f66be427aab21879ee90

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\8vOqW\MFC42u.dll

MD5 7191d466bac98bd59c983c12d39b72ec
SHA1 e6423cc4adb5d806a3f858d41880c7cb54198848
SHA256 9f11febcd2703ba53220b60ad6e339cf31ca8fedc85c4b57055d26a37ae86c6c
SHA512 508558d3395c7d1a4d3f25dcee6a64935ba104ff1db9f1f7ef5e493db46bcb61877e8d98e60365d7b9479778e992a341dc43b370a5740d5c2b9792265c962e8f

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-28 06:25

Reported

2024-01-28 06:28

Platform

win10v2004-20231215-en

Max time kernel

152s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c6145fc88e55d7bac1db14f71a9f30c.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\sM1H\dwm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rDs\tabcal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\R3iKU8XX\dccw.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gdfgjdhwrlpouj = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\PRINTE~1\\Y7\\tabcal.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\R3iKU8XX\dccw.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\sM1H\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\rDs\tabcal.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3524 wrote to memory of 652 N/A N/A C:\Windows\system32\dwm.exe
PID 3524 wrote to memory of 652 N/A N/A C:\Windows\system32\dwm.exe
PID 3524 wrote to memory of 2244 N/A N/A C:\Users\Admin\AppData\Local\sM1H\dwm.exe
PID 3524 wrote to memory of 2244 N/A N/A C:\Users\Admin\AppData\Local\sM1H\dwm.exe
PID 3524 wrote to memory of 2020 N/A N/A C:\Windows\system32\tabcal.exe
PID 3524 wrote to memory of 2020 N/A N/A C:\Windows\system32\tabcal.exe
PID 3524 wrote to memory of 4512 N/A N/A C:\Users\Admin\AppData\Local\rDs\tabcal.exe
PID 3524 wrote to memory of 4512 N/A N/A C:\Users\Admin\AppData\Local\rDs\tabcal.exe
PID 3524 wrote to memory of 4244 N/A N/A C:\Windows\system32\dccw.exe
PID 3524 wrote to memory of 4244 N/A N/A C:\Windows\system32\dccw.exe
PID 3524 wrote to memory of 2216 N/A N/A C:\Users\Admin\AppData\Local\R3iKU8XX\dccw.exe
PID 3524 wrote to memory of 2216 N/A N/A C:\Users\Admin\AppData\Local\R3iKU8XX\dccw.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c6145fc88e55d7bac1db14f71a9f30c.dll,#1

C:\Windows\system32\dwm.exe

C:\Windows\system32\dwm.exe

C:\Users\Admin\AppData\Local\sM1H\dwm.exe

C:\Users\Admin\AppData\Local\sM1H\dwm.exe

C:\Windows\system32\tabcal.exe

C:\Windows\system32\tabcal.exe

C:\Users\Admin\AppData\Local\rDs\tabcal.exe

C:\Users\Admin\AppData\Local\rDs\tabcal.exe

C:\Windows\system32\dccw.exe

C:\Windows\system32\dccw.exe

C:\Users\Admin\AppData\Local\R3iKU8XX\dccw.exe

C:\Users\Admin\AppData\Local\R3iKU8XX\dccw.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp

Files

memory/1416-1-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1416-0-0x000002621CB30000-0x000002621CB37000-memory.dmp

memory/3524-5-0x00007FFC634FA000-0x00007FFC634FB000-memory.dmp

memory/3524-4-0x0000000003060000-0x0000000003061000-memory.dmp

memory/3524-7-0x0000000140000000-0x0000000140190000-memory.dmp

memory/1416-8-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-9-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-10-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-11-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-12-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-14-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-13-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-16-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-17-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-18-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-19-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-20-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-15-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-22-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-21-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-23-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-24-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-25-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-27-0x0000000001300000-0x0000000001307000-memory.dmp

memory/3524-26-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-34-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-37-0x00007FFC64D00000-0x00007FFC64D10000-memory.dmp

memory/3524-44-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3524-46-0x0000000140000000-0x0000000140190000-memory.dmp

C:\Users\Admin\AppData\Local\sM1H\dwm.exe

MD5 5c27608411832c5b39ba04e33d53536c
SHA1 f92f8b7439ce1de4c297046ed1d3ff9f20bc97af
SHA256 0ac827c9e35cdaa492ddd435079415805dcc276352112b040bcd34ef122cf565
SHA512 1fa25eabc08dff9ea25dfa7da310a677927c6344b76815696b0483f8860fa1469820ff15d88a78ed32f712d03003631d9aceaf9c9851de5dd40c1fc2a7bc1309

C:\Users\Admin\AppData\Local\sM1H\dxgi.dll

MD5 c519942b597381e9b70d9a30247251a7
SHA1 b0bc70255e4db35b850ae46176c92708cef0d681
SHA256 f6e8d036d4969a1d4c0cc6e27a2966fe0f8f4dfe776820caed7a5154e2f73fca
SHA512 0f349b510cbe96df7ddc11dd99eea9b0966d343fc3c641f84066cc3d27fe54733b3c76ed54db27d916e24a0f24ac1eed101346f54bd76645f5d3191b8d7524ce

memory/2244-60-0x0000000140000000-0x0000000140191000-memory.dmp

memory/2244-59-0x0000020E16DC0000-0x0000020E16DC7000-memory.dmp

memory/2244-63-0x0000000140000000-0x0000000140191000-memory.dmp

C:\Users\Admin\AppData\Local\rDs\tabcal.exe

MD5 40f4014416ff0cbf92a9509f67a69754
SHA1 1798ff7324724a32c810e2075b11c09b41e4fede
SHA256 f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512 646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259

C:\Users\Admin\AppData\Local\rDs\HID.DLL

MD5 fa87db1abd4904173d0d203f561c43d6
SHA1 96b5c50922e65c0a16b016c678ea5e9477f5dc19
SHA256 32602c9f7506484917ef9ae166b76f71e52bb18cc40314b87cba1c9a4cccf89a
SHA512 c573bd4c0bb6bfeabafbcb7043a38f7ad30ba6a56abcb505af509a1cebb3add3ef79959557e7c49438c9c4c02b3bc9f322ab8e88e6a784f091d3dcc6d4282bde

memory/4512-73-0x0000020B153C0000-0x0000020B153C7000-memory.dmp

memory/4512-78-0x0000000140000000-0x0000000140191000-memory.dmp

C:\Users\Admin\AppData\Local\R3iKU8XX\dccw.exe

MD5 cb9374911bf5237179785c739a322c0f
SHA1 3f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256 f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA512 9d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be

C:\Users\Admin\AppData\Local\R3iKU8XX\mscms.dll

MD5 45578b1d86f6a6f8c4eca7e716e6e3fa
SHA1 82c555590f63db2394d97363b905604502caad7f
SHA256 6b9f0f29d2c150fafebbbeeb4acf960549da235aeb1ad855dd220d37bf99b54e
SHA512 2faa4760eb5c7d9fd55cdf383d645554f8dfbf55227365ac81bdb394a727b7c82f1e6cdc4aeb348a7478abc543281e5da2436aa1e210e7eb5be41826c4bab387

memory/2216-89-0x00000197AE700000-0x00000197AE707000-memory.dmp

memory/2216-90-0x0000000140000000-0x0000000140192000-memory.dmp

memory/2216-95-0x0000000140000000-0x0000000140192000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

MD5 5abfd25ac1e6fea0ecb50a5d2e80a29a
SHA1 f9647e2ca670269669b35f6ded4ca6a4fd756893
SHA256 519b0c569e6b857a995ead2ccbc6ba66818ed464660ad6e7fe4bd0666a9ddced
SHA512 c1bc76624900264b90f1671e26dccd8ad91bca141f2b9a7a9b5160987df2386123559b1bd53ce4402ba3e50bae443d4a7e528588a7632e59f43bbc82514b4404