8eeda0849b8bffc5d26ee56f02162f2e75e4271c4257c309197f3645fac47c03

Analysis

max time kernel
84s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Build.exe
Size 11.9MB
Sample240302-vvtvmsfc9v
SHA256 8eeda0849b8bffc5d26ee56f02162f2e75e4271c4257c309197f3645fac47c03
MD5 2fbf75fbac01d42161fdeb6adbd0d979
SHA1 3ef5530a433923276191eec8d98aa462194aa829
SHA512 1c208f3a5202c578e6f70474566f0929954b5678215ad962f84a7febee1b9c7a0a1cc3040763192a3ed9ebdf395bd9aa113ee313bf6f951973a717fec423472d
SSDEEP 196608:AFH/xtSYJodEawY/7HPjloM1LiUIX099RYU9ptAzvZaZoM2S5HQoFKArPWug0Vg:AFfxtjJ/an7HPZ12TE99R3zmhbShKArI
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Build.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	Setup.exe
File created	C:\Windows\system32\drivers\etc\hosts	kvkinxkledtt.exe
File created	C:\Windows\system32\drivers\etc\hosts	kvkinxkledtt.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WindowsComplite\ImagePath = "C:\\ProgramData\\hmtufamemhvn\\kvkinxkledtt.exe"	services.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Build.exe

Executes dropped EXE 4 IoCs

pid	Process
2564	Setup.exe
2440	Updater.exe
2240	kvkinxkledtt.exe
1032	kvkinxkledtt.exe

Loads dropped DLL 13 IoCs

pid	Process
2956	Build.exe
2956	Build.exe
2956	Build.exe
2440	Updater.exe
2440	Updater.exe
2440	Updater.exe
2392	WerFault.exe
2392	WerFault.exe
2392	WerFault.exe
2392	WerFault.exe
2392	WerFault.exe
468	services.exe
468	services.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2956-0-0x0000000000400000-0x000000000141D000-memory.dmp	themida
behavioral1/memory/2956-25-0x0000000000400000-0x000000000141D000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Build.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	icanhazip.com
4	ipinfo.io
5	ipinfo.io

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	kvkinxkledtt.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Setup.exe
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	kvkinxkledtt.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2956	Build.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
2240	kvkinxkledtt.exe
2240	kvkinxkledtt.exe
2240	kvkinxkledtt.exe
1032	kvkinxkledtt.exe
1032	kvkinxkledtt.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 1640	2564	Setup.exe	55
PID 2240 set thread context of 108	2240	kvkinxkledtt.exe	86
PID 2240 set thread context of 3016	2240	kvkinxkledtt.exe	91
PID 2240 set thread context of 2664	2240	kvkinxkledtt.exe	92
PID 1032 set thread context of 2056	1032	kvkinxkledtt.exe	116

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini	WMIADAP.EXE
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2036	sc.exe
1272	sc.exe
1064	sc.exe
2512	sc.exe
1984	sc.exe
1332	sc.exe
592	sc.exe
1824	sc.exe
2016	sc.exe
2160	sc.exe
2352	sc.exe
2320	sc.exe
2812	sc.exe
1100	sc.exe
2748	sc.exe
276	sc.exe
1652	sc.exe
1144	sc.exe
1348	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	2440	WerFault.exe	29

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 204967d5c56cda01	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2956	Build.exe
2564	Setup.exe
2916	powershell.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
2564	Setup.exe
2564	Setup.exe
2564	Setup.exe
1640	dialer.exe
1640	dialer.exe
2240	kvkinxkledtt.exe
2956	powershell.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
1640	dialer.exe
2240	kvkinxkledtt.exe
2240	kvkinxkledtt.exe
1640	dialer.exe
1640	dialer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	Updater.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeShutdownPrivilege	1504	powercfg.exe
Token: SeShutdownPrivilege	436	powercfg.exe
Token: SeShutdownPrivilege	476	powercfg.exe
Token: SeShutdownPrivilege	1032	powercfg.exe
Token: SeDebugPrivilege	2564	Setup.exe
Token: SeDebugPrivilege	1640	dialer.exe
Token: SeAuditPrivilege	872	svchost.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	872	svchost.exe
Token: SeIncreaseQuotaPrivilege	872	svchost.exe
Token: SeSecurityPrivilege	872	svchost.exe
Token: SeTakeOwnershipPrivilege	872	svchost.exe
Token: SeLoadDriverPrivilege	872	svchost.exe
Token: SeSystemtimePrivilege	872	svchost.exe
Token: SeBackupPrivilege	872	svchost.exe
Token: SeRestorePrivilege	872	svchost.exe
Token: SeShutdownPrivilege	872	svchost.exe
Token: SeSystemEnvironmentPrivilege	872	svchost.exe
Token: SeUndockPrivilege	872	svchost.exe
Token: SeManageVolumePrivilege	872	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	872	svchost.exe
Token: SeIncreaseQuotaPrivilege	872	svchost.exe
Token: SeSecurityPrivilege	872	svchost.exe
Token: SeTakeOwnershipPrivilege	872	svchost.exe
Token: SeLoadDriverPrivilege	872	svchost.exe
Token: SeSystemtimePrivilege	872	svchost.exe
Token: SeBackupPrivilege	872	svchost.exe
Token: SeRestorePrivilege	872	svchost.exe
Token: SeShutdownPrivilege	872	svchost.exe
Token: SeSystemEnvironmentPrivilege	872	svchost.exe
Token: SeUndockPrivilege	872	svchost.exe
Token: SeManageVolumePrivilege	872	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	872	svchost.exe
Token: SeIncreaseQuotaPrivilege	872	svchost.exe
Token: SeSecurityPrivilege	872	svchost.exe
Token: SeTakeOwnershipPrivilege	872	svchost.exe
Token: SeLoadDriverPrivilege	872	svchost.exe
Token: SeSystemtimePrivilege	872	svchost.exe
Token: SeBackupPrivilege	872	svchost.exe
Token: SeRestorePrivilege	872	svchost.exe
Token: SeShutdownPrivilege	872	svchost.exe
Token: SeSystemEnvironmentPrivilege	872	svchost.exe
Token: SeUndockPrivilege	872	svchost.exe
Token: SeManageVolumePrivilege	872	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	872	svchost.exe
Token: SeIncreaseQuotaPrivilege	872	svchost.exe
Token: SeSecurityPrivilege	872	svchost.exe
Token: SeTakeOwnershipPrivilege	872	svchost.exe
Token: SeLoadDriverPrivilege	872	svchost.exe
Token: SeSystemtimePrivilege	872	svchost.exe
Token: SeBackupPrivilege	872	svchost.exe
Token: SeRestorePrivilege	872	svchost.exe
Token: SeShutdownPrivilege	872	svchost.exe
Token: SeSystemEnvironmentPrivilege	872	svchost.exe
Token: SeUndockPrivilege	872	svchost.exe
Token: SeManageVolumePrivilege	872	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	872	svchost.exe
Token: SeIncreaseQuotaPrivilege	872	svchost.exe
Token: SeSecurityPrivilege	872	svchost.exe
Token: SeTakeOwnershipPrivilege	872	svchost.exe
Token: SeLoadDriverPrivilege	872	svchost.exe
Token: SeSystemtimePrivilege	872	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2564	2956	Build.exe	28
PID 2956 wrote to memory of 2564	2956	Build.exe	28
PID 2956 wrote to memory of 2564	2956	Build.exe	28
PID 2956 wrote to memory of 2564	2956	Build.exe	28
PID 2956 wrote to memory of 2440	2956	Build.exe	29
PID 2956 wrote to memory of 2440	2956	Build.exe	29
PID 2956 wrote to memory of 2440	2956	Build.exe	29
PID 2956 wrote to memory of 2440	2956	Build.exe	29
PID 2956 wrote to memory of 2440	2956	Build.exe	29
PID 2956 wrote to memory of 2440	2956	Build.exe	29
PID 2956 wrote to memory of 2440	2956	Build.exe	29
PID 2440 wrote to memory of 2392	2440	Updater.exe	33
PID 2440 wrote to memory of 2392	2440	Updater.exe	33
PID 2440 wrote to memory of 2392	2440	Updater.exe	33
PID 2440 wrote to memory of 2392	2440	Updater.exe	33
PID 2440 wrote to memory of 2392	2440	Updater.exe	33
PID 2440 wrote to memory of 2392	2440	Updater.exe	33
PID 2440 wrote to memory of 2392	2440	Updater.exe	33
PID 2900 wrote to memory of 624	2900	cmd.exe	38
PID 2900 wrote to memory of 624	2900	cmd.exe	38
PID 2900 wrote to memory of 624	2900	cmd.exe	38
PID 2564 wrote to memory of 1640	2564	Setup.exe	55
PID 2564 wrote to memory of 1640	2564	Setup.exe	55
PID 2564 wrote to memory of 1640	2564	Setup.exe	55
PID 2564 wrote to memory of 1640	2564	Setup.exe	55
PID 2564 wrote to memory of 1640	2564	Setup.exe	55
PID 2564 wrote to memory of 1640	2564	Setup.exe	55
PID 2564 wrote to memory of 1640	2564	Setup.exe	55
PID 1640 wrote to memory of 424	1640	dialer.exe	5
PID 1640 wrote to memory of 468	1640	dialer.exe	6
PID 1640 wrote to memory of 484	1640	dialer.exe	7
PID 1640 wrote to memory of 492	1640	dialer.exe	8
PID 1640 wrote to memory of 604	1640	dialer.exe	9
PID 1640 wrote to memory of 688	1640	dialer.exe	10
PID 1640 wrote to memory of 764	1640	dialer.exe	11
PID 1640 wrote to memory of 832	1640	dialer.exe	12
PID 468 wrote to memory of 2240	468	services.exe	64
PID 468 wrote to memory of 2240	468	services.exe	64
PID 468 wrote to memory of 2240	468	services.exe	64
PID 1640 wrote to memory of 872	1640	dialer.exe	13
PID 1640 wrote to memory of 2240	1640	dialer.exe	64
PID 1640 wrote to memory of 984	1640	dialer.exe	15
PID 1640 wrote to memory of 300	1640	dialer.exe	16
PID 1640 wrote to memory of 488	1640	dialer.exe	17
PID 1640 wrote to memory of 1052	1640	dialer.exe	18
PID 1640 wrote to memory of 1128	1640	dialer.exe	19
PID 1640 wrote to memory of 1168	1640	dialer.exe	20
PID 1640 wrote to memory of 1256	1640	dialer.exe	21
PID 1640 wrote to memory of 2364	1640	dialer.exe	24
PID 1640 wrote to memory of 2852	1640	dialer.exe	25
PID 1640 wrote to memory of 2888	1640	dialer.exe	30
PID 872 wrote to memory of 2412	872	svchost.exe	66
PID 872 wrote to memory of 2412	872	svchost.exe	66
PID 872 wrote to memory of 2412	872	svchost.exe	66
PID 1640 wrote to memory of 2320	1640	dialer.exe	61
PID 1640 wrote to memory of 2412	1640	dialer.exe	66
PID 1640 wrote to memory of 1556	1640	dialer.exe	62
PID 1640 wrote to memory of 2240	1640	dialer.exe	64
PID 1640 wrote to memory of 2956	1640	dialer.exe	65
PID 1640 wrote to memory of 2412	1640	dialer.exe	66
PID 1640 wrote to memory of 2416	1640	dialer.exe	67
PID 1640 wrote to memory of 2060	1640	dialer.exe	68
PID 2060 wrote to memory of 2808	2060	cmd.exe	72
PID 2060 wrote to memory of 2808	2060	cmd.exe	72

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:604
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -Embedding
    3⤵
    PID:1612
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
    3⤵
    PID:1384
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:688
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  - Drops file in System32 directory
  PID:764
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:832
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1168
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:2412
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:984
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:300
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:488
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1052
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1128
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2364
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2852
- C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe
  C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:2808
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2512
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2812
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1824
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2016
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1100
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:1880
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:560
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    PID:1808
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    PID:1940
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:108
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:3016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Drops file in System32 directory
      PID:2432
  - - C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe
      "C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      PID:1032
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Drops file in System32 directory
        
        PID:1756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:1820
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Drops file in Windows directory
        
        PID:852
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:1348
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:2748
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:2160
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:1984
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:1332
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        
        PID:2044
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        
        PID:2000
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        
        PID:2252
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        
        PID:2820
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        
        PID:2056
- - C:\Windows\system32\dialer.exe
    dialer.exe
    3⤵
    PID:2664

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:492

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Users\Admin\AppData\Local\Temp\Build.exe
  "C:\Users\Admin\AppData\Local\Temp\Build.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        Drops file in Windows directory
        
        PID:624
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:2036
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:276
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:1652
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:2352
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:592
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:476
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:436
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1032
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1504
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1640
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "WindowsComplite"
      4⤵
      Launches sc.exe
      PID:1272
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "WindowsComplite" binpath= "C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:1144
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:1064
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "WindowsComplite"
      4⤵
      Launches sc.exe
      PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Updater.exe
    "C:\Users\Admin\AppData\Local\Temp\Updater.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 1304
      4⤵
      Loads dropped DLL
      Program crash
      PID:2392

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1065183205-766207086-92716527-4428420251109806910-180696026821470527221752229018"
1⤵
PID:2888

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "557134779-1498576867-1308692231-161181331641159871-367229131-162851804-150756141"
1⤵
PID:1556

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1263474899-60939454210946499001397830831-2105298923-2068113459-873205744-2071861937"
1⤵
PID:2416

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "602601837-556360114-12550421096887970534244806662128754886195935785-1865126774"
1⤵
PID:1960

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-61132864919799223001823021669-2071490618-1016967776459515692-13985524981098809220"
1⤵
PID:1536

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-14486762021892730694-116808514411502139721095833130-509730004465069034-699328623"
1⤵
PID:1388

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "17027888112178199042128189655853359367644488104672900149-1239954902-624008010"
1⤵
PID:2420

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "607282451-14694021911935584762-210429513-1791728636-7379298141662388817499814164"
1⤵
PID:2400

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "21403421101086303742229526128364131987-19310653541105534194-19526762941963891935"
1⤵
PID:2740

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "21047194201556948558130824468736985712410556746591271889272-1672247633-728445341"
1⤵
PID:1228

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-156009591-622341397-2018582605-1234274732-1902964811137941017-1849553854302543451"
1⤵
PID:3032

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-115216806020481023211129656937-20144779372053933038-1512948432-1735860714-2102862850"
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

kvkinxkledtt.exe

Path C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe
Size 2.3MB
SHA256 4b05ac2445a1ffa6668923ffa1c3888550cb8b940cc7ecb903d324d99ec6e827
MD5 65fb1fa0968db3f1764e171b98cdd7f5
SHA1 0779acd3605ffd1f20965629156386795b72e9e9
SHA512 03342f0fc08a2c1769454457f540fe23614ffc7d3498670c050e3ff6481a4bb86c149606db172c3ad74118d83afee7bf938e0bfca983c91e44d4855ced3291a4
SSDEEP 49152:SuyDWzSZDRR2LaGJoQ3jAQIecy28U/FYJSqI1FCP4:S/bZL2TJb3cQI42TyJtmCP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvkinxkledtt.exe

Path C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe
Size 1.8MB
SHA256 108cf922fff56c9ffe00535f3d3b9d4c19ea27f750e0419be49fa2d900166a05
MD5 7510795471092ff89c3d911cb1f5e83f
SHA1 a2101d4c6a5c06bb9247c579c92d3e5383a18805
SHA512 f2bd9adbf6423b4cbd04a87cc7cc450dd6c8fbb983afd503503ae92ce5e764c22ecb3c16821f5f5affbcd4bf4b378a50b67c7fefecfb1bb0a9c4b93545f26e4d
SSDEEP 24576:Su14DqTbF44ZqB77geL5WmjR9BHxb9T2LtEGwxXKMqN/yQ3bvAN0zIecv0Dn2odD:SuyDWzSZDRR2LaGJoQ3jAQIecy28U4
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvkinxkledtt.exe

Path C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe
Size 4.0MB
SHA256 738c8849b70bee0338d3624b52c66d7458c3e44380cbb5efe5c6450e61f5bcb7
MD5 5bc21a946cf307eb178becc43cbf9eba
SHA1 f7d8df030aa467ece82cadfa2400210fa7054ff6
SHA512 03e6078c8be306243d3794afdc7931e3378069145642ad0e9709540302ba4957fb0ac6ddd76916e3f685c7508968d6ec20149894fdf168646bb5a7f9af271686
SSDEEP 98304:S/bZL2TJb3cQI42TyJtmCPInsv/WYojohnse/h:S/bETeQIhTyunsvebUhnt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup.exe
Size 2.8MB
SHA256 f6ef740075b9305a5f746488bbc9ab933c005e0b5c07e89aa617d32c81f8c606
MD5 41224012e6453b769036bf38a0485584
SHA1 8aa854d3fb94bbe66dd9232c2dc0bd0fd1ee48d6
SHA512 d96923e548e268fdbfcb5902a7041241b567ed8f58d8f8cea79bb9171b85c17e2cac6ddb692164e742e4eed7ac59136f7a805eabf8b132e6504d830dcfb005c0
SSDEEP 49152:SuyDWzSZDRR2LaGJoQ3jAQIecy28U/FYJSqI1FCPInKY4VHq:S/bZL2TJb3cQI42TyJtmCPInf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup.exe
Size 2.6MB
SHA256 01663f99b1c8650ef0c0175d5a8dc6c22b88ce758892dd37f3d4b33435aa0503
MD5 223a77a3aaf21f6749e0a7cde617801f
SHA1 5351b25ad7026a009ec46f8e2a9dbb1748875903
SHA512 72ef948cdf2ef9e83b4db76c7825aaed36c86469abfdccd540fcba32678ff63ac09dd72713fb3981251212fd4e29aaedfc01ff852929e5b0d356e40b5aa7f8ea
SSDEEP 49152:SuyDWzSZDRR2LaGJoQ3jAQIecy28U/FYJSqI1FCPInKX:S/bZL2TJb3cQI42TyJtmCPIn2
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 145KB
SHA256 14ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a
MD5 19c7052de3b7281b4c1c6bfbb543c5dc
SHA1 d2e12081a14c1069c89f2cee7357a559c27786e7
SHA512 289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83
SSDEEP 768:5Kb+j2tTFyuhttrBq2azmYxTXjvOXZODr9Tc/RU96PIr:5Kb+j2tTPhttdq2g7OXZODr9T+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 154KB
SHA256 cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
MD5 f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1 961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA512 116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294
SSDEEP 768:jLLxU1GSWnWRIV9t1N2r+BA6GabCOcxyxePC5rcLtY4NcgBqL6QenMfQZU61lyAv:jLLxUBWn92k6W3py
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 145KB
SHA256 68d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
MD5 ce233fa5dc5adcb87a5185617a0ff6ac
SHA1 2e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA512 1e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2
SSDEEP 3072:Sk/cq2lPtwvg0KS9mI+EP5YVcbuo3jfz2F/cKuEF2Dsy:SQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 142KB
SHA256 9de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
MD5 d73172c6cb697755f87cd047c474cf91
SHA1 abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA512 7c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6
SSDEEP 768:0hCx4l7JXlrCE3eAGua2eSXrAxmI4yYf4w91Nw+vB2U++P+pmij4Vh6TzoqAbqGB:0Axo7JX9E2hH+eQy
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc011.dat

Path C:\Windows\System32\perfc011.dat
Size 118KB
SHA256 690ebf33940e7d22aeef120d30cc8b1731b2b18ce0cb4b2db89679735809312c
MD5 045b3a28859ed815f97e17fcebadf523
SHA1 a3cfaf297b3ef6d2e7ae0e33b9e7a3f212c7c5bd
SHA512 d1836a85871c5c11efc407827bb87af4356297a8c498310de45cb322827082622c56cccee7d22c2e2a2f6894a33589534b9f516736005107571d7efade1e9de5
SSDEEP 768:BwwR1fQRDl6VE3qG2T/YULhOdQfUwe6RzqgX2rIfwUKTzWPTryQiIAMyOf06PIr:X1i33qG2JRzqgX2VWi9NnOf5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 680KB
SHA256 24c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
MD5 b69ab3aeddb720d6ef8c05ff88c23b38
SHA1 d830c2155159656ed1806c7c66cae2a54a2441fa
SHA512 4c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d
SSDEEP 3072:chpwBxTEsmVdxOpM88RMgfQuRx+PYZ1XrcPDtzcSx2A8q1JuqaB32rSrSVCxls/4:/PZmiDDnKofxM
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 646KB
SHA256 9bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
MD5 aecab86cc5c705d7a036cba758c1d7b0
SHA1 e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA512 e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8
SSDEEP 3072:PdGEJowE4j0kRZnLOlMZ8M6d0UHjYnWB7BxLh0okf9zQdcpM7q3TBQpsAMXV7c99:j8M6d0SZ9W1m
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 727KB
SHA256 ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
MD5 7d0bac4e796872daa3f6dc82c57f4ca8
SHA1 b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA512 145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
SSDEEP 3072:2f57F17Fetjvtx1tTSam86nAgnjXSn5EBGP5pNxXoTbMd4Xn8BoMjHArzThBOZnz:Ntjvtx1tTS3n3jXCP5XZnUOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 727KB
SHA256 2e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
MD5 5f684ce126de17a7d4433ed2494c5ca9
SHA1 ce1a30a477daa1bac2ec358ce58731429eafe911
SHA512 4d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
SSDEEP 3072:8S0+6JpGytgViPIiy4auTs62gdDIefsnnSRRDwcBRKZNtflhHZneBZoVoZfMdtBi:mTsIrCeJqq
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 722KB
SHA256 eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
MD5 4623482c106cf6cc1bac198f31787b65
SHA1 5abb0decf7b42ef5daf7db012a742311932f6dad
SHA512 afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
SSDEEP 3072:gd8gxHwjkUXx5q8d8tj/v9GLcxcx8oEpvnLB+aVGul9oLim4dDXBnZdQTKSBf1TJ:oHj/v9GLnaVGuEkB4Bf/
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 406KB
SHA256 646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
MD5 54c674d19c0ff72816402f66f6c3d37c
SHA1 2dcc0269545a213648d59dc84916d9ec2d62a138
SHA512 4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f
SSDEEP 3072:Ej83gD6HfgO/235TjhpoMnkrBI4BHvjxiBzBDVTooFosWbEh3KlpsOdciKXEqB3e:o83r/23hLDfcHyKK8BOFi
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApRpl.h

Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
Size 3KB
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
MD5 SHA1 SHA512

Submit Download

WmiApRpl.ini

Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Size 27KB
SHA256 5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
MD5 46d08e3a55f007c523ac64dce6dcf478
SHA1 62edf88697e98d43f32090a2197bead7e7244245
SHA512 b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2VVNuDu:esoW/g4kg4oG4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

dpuiidgwfqma.sys

Path C:\Windows\TEMP\dpuiidgwfqma.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1007B
SHA256 d47944cc0756d7b558fd2ee5cc0e1f8aeb195c22b5fa40c912130d1c36958395
MD5 3a9662312614b856b548c94bc410cd23
SHA1 e008df0cd134359e2ae897975f5a258cdda67cef
SHA512 435a8555c0c90668baaf10c6c9e016b651bb14b1f0fe0427dade063d7de65621fd1bbb75e667276e5ba8049e30d4f018b86b5267df0b7b731c1cc314eaede2ed
MD5 SHA1 SHA512

Submit Download

kvkinxkledtt.exe

Path \??\c:\programdata\hmtufamemhvn\kvkinxkledtt.exe
Size 5.7MB
SHA256 cc26addc4b8ebd1c6b5fd726d1eb7924dbc4946fa0d904660e22e75b118f29e7
MD5 7341e0a697d7ce2955a0874de7658a5c
SHA1 23c5dfce9531377fc48cb9db2ceff6dd8e034233
SHA512 e6ddfdca4f2f4a7b8ac9f6fc8c882c26a27c2ed679b8ce9b0daa2748419302bdee507aebce764378d7c4f9c1ef83716cd1cb440cc08644ece8d21c190c729619
SSDEEP 98304:S/bZL2TJb3cQI42TyJtmCPInsv/WYojohnse/qSTwJWHBg9ow:S/bETeQIhTyunsvebUhnuFQB2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path \??\c:\users\admin\appdata\local\temp\setup.exe
Size 1.2MB
SHA256 2023d162d32b348aa8e2a84426ef61a3fb6de4fca7567a55e2075e4a4442d3d4
MD5 07fc27b99d7c9705d35688ceeb87942b
SHA1 a311f9ec6b3f3d35b530726d72f0bf75c57a0d8a
SHA512 bec3faf4fb7dcdd312693aa999a52e071b4e148b3e8b9bdce35ac19801b05a869cbfa3787001b0f417374f6bf2679601e485c88f22c9579bddfc1c5ccd50b43c
SSDEEP 24576:Su14DqTbF44ZqB77geL5WmjR9BHxb9T2LtEGwxXKMqN/x:SuyDWzSZDRR2LaGJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvkinxkledtt.exe

Path \ProgramData\hmtufamemhvn\kvkinxkledtt.exe
Size 2.9MB
SHA256 c4a97fa39768d31c3e4e1cd43364383145b378663465ed28250bb9170085c9ec
MD5 9b6492f34c224737ec012bc7d22f7564
SHA1 d3df323038e39a19ceae2be539ba3b8b046544f3
SHA512 6ac9da0b9ffa11e88a3ceaa31f91c7ad9eeb8689148607d9936f4cf3aeb2cddd95d7b83138053be3b96d8220c52813a21d51c662976ca77161ae0290792baa24
SSDEEP 49152:SuyDWzSZDRR2LaGJoQ3jAQIecy28U/FYJSqI1FCPInKY4VHLBZ/m:S/bZL2TJb3cQI42TyJtmCPInsv/m
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvkinxkledtt.exe

Path \ProgramData\hmtufamemhvn\kvkinxkledtt.exe
Size 2.2MB
SHA256 79a6d14033fe2ab86925dce75d8132881d77f1986ac33e025dd6c933f5f37897
MD5 679f4287e7dee82e563e3b973e8b2126
SHA1 2e8248caa03f1595487e67feabfa75eeeacabb55
SHA512 f7c6c62c2ec24b74aa3f3bd4f8b0945fbb2f52d98f2c37c139da7cd263f76730ff0980e265b83e49a5aa80bae6217269188bc1fe1c9e455104550bd48fa5f848
SSDEEP 49152:SuyDWzSZDRR2LaGJoQ3jAQIecy28U/FYJSqI1FO:S/bZL2TJb3cQI42TyJtmO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path \Users\Admin\AppData\Local\Temp\Setup.exe
Size 1.7MB
SHA256 6c0f48ccb903c9694df361e34ebc1c0093165debb69f9f11877f348312bfaf8b
MD5 e42412b042691cbe4752ea26910949f7
SHA1 01ed752518583c39e129a00d62bd5a52e310c1e1
SHA512 ac1ae359390087b30153be1bcce66901bd18ae1f95b97e28823f416336249caf802eecc7bed40ef91c6b6e5ada003dbb86c9849f3ac5c6e1be3dd3cabbe18a9b
SSDEEP 24576:Su14DqTbF44ZqB77geL5WmjR9BHxb9T2LtEGwxXKMqN/yQ3bvAN0zIecv0Dn2s:SuyDWzSZDRR2LaGJoQ3jAQIecy2s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path \Users\Admin\AppData\Local\Temp\Setup.exe
Size 1.6MB
SHA256 3f81eca51b3012214b4e8608c6b5d23a6f7085ce1ca6e911f17fc583c138f2b9
MD5 a283f14bb5603859452416118e2f013a
SHA1 9a03917bb73997047bed80167f1a8036c19f0327
SHA512 8a4018a745173d03111d25cc74b1d72b1c83219560167266efd400c8eb7034cdaa61bb9f391b5a8392c83245e7363783e20c2884addef7ebeec11cfaed6045fe
SSDEEP 24576:Su14DqTbF44ZqB77geL5WmjR9BHxb9T2LtEGwxXKMqN/yQ3bvAN0zIecv0Dn2q:SuyDWzSZDRR2LaGJoQ3jAQIecy2q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Updater.exe

Path \Users\Admin\AppData\Local\Temp\Updater.exe
Size 984KB
SHA256 2e5a498e9299a5a6d7ca9d36def6d2f546812a34db0fe91528ab586dd9d07a18
MD5 d5ea67d392c23f20921d26cba0fdf284
SHA1 572013524756c6323a198810cf63c32d90044f46
SHA512 d5159344dd389c18f2d6ec9911a4a5a9b1240cefb88ab8bf8099f9ce3918915ccd39466ef750f3b3cafab2096e550e7fd07a8680780b7383f45c601603b49b7d
SSDEEP 24576:mffw+Jwz/S/6S+8Zk5BkAOtlaapjMkKTo:mnw+W7SCS+8qch
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/300-185-0x0000000000830000-0x000000000085B000-memory.dmp

Download

memory/424-103-0x0000000077051000-0x0000000077052000-memory.dmp

Download

memory/424-73-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/424-98-0x0000000000970000-0x000000000099B000-memory.dmp

Download

memory/424-66-0x00000000008A0000-0x00000000008C4000-memory.dmp

Download

memory/424-67-0x00000000008A0000-0x00000000008C4000-memory.dmp

Download

memory/424-69-0x0000000000970000-0x000000000099B000-memory.dmp

Download

memory/424-71-0x000007FEBD800000-0x000007FEBD810000-memory.dmp

Download

memory/468-77-0x0000000000250000-0x000000000027B000-memory.dmp

Download

memory/468-82-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/468-79-0x000007FEBD800000-0x000007FEBD810000-memory.dmp

Download

memory/468-160-0x000000013F980000-0x0000000140EB7000-memory.dmp

Download

memory/468-153-0x000000013F980000-0x0000000140EB7000-memory.dmp

Download

memory/468-112-0x0000000000250000-0x000000000027B000-memory.dmp

Download

memory/484-116-0x00000000009E0000-0x0000000000A0B000-memory.dmp

Download

memory/484-81-0x00000000009E0000-0x0000000000A0B000-memory.dmp

Download

memory/484-84-0x000007FEBD800000-0x000007FEBD810000-memory.dmp

Download

memory/484-89-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/488-194-0x0000000001C00000-0x0000000001C2B000-memory.dmp

Download

memory/488-198-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/492-88-0x0000000000300000-0x000000000032B000-memory.dmp

Download

memory/492-124-0x0000000000300000-0x000000000032B000-memory.dmp

Download

memory/492-94-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/492-93-0x000007FEBD800000-0x000007FEBD810000-memory.dmp

Download

memory/604-131-0x00000000004F0000-0x000000000051B000-memory.dmp

Download

memory/604-101-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/604-99-0x000007FEBD800000-0x000007FEBD810000-memory.dmp

Download

memory/604-97-0x00000000004F0000-0x000000000051B000-memory.dmp

Download

memory/688-110-0x000007FEBD800000-0x000007FEBD810000-memory.dmp

Download

memory/688-107-0x0000000000560000-0x000000000058B000-memory.dmp

Download

memory/688-136-0x0000000000560000-0x000000000058B000-memory.dmp

Download

memory/688-111-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/764-123-0x0000000000A30000-0x0000000000A5B000-memory.dmp

Download

memory/764-165-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/764-163-0x0000000000A30000-0x0000000000A5B000-memory.dmp

Download

memory/832-169-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/832-118-0x0000000000990000-0x00000000009BB000-memory.dmp

Download

memory/832-139-0x0000000000990000-0x00000000009BB000-memory.dmp

Download

memory/872-173-0x0000000000860000-0x000000000088B000-memory.dmp

Download

memory/872-182-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/984-176-0x00000000009E0000-0x0000000000A0B000-memory.dmp

Download

memory/1052-210-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/1052-204-0x0000000000850000-0x000000000087B000-memory.dmp

Download

memory/1128-214-0x0000000001ED0000-0x0000000001EFB000-memory.dmp

Download

memory/1128-217-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/1168-234-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/1168-230-0x00000000001F0000-0x000000000021B000-memory.dmp

Download

memory/1256-235-0x0000000002AF0000-0x0000000002B1B000-memory.dmp

Download

memory/1640-57-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1640-59-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1640-54-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1640-55-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1640-56-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1640-62-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1640-60-0x0000000077000000-0x00000000771A9000-memory.dmp

Download

memory/1640-61-0x0000000076EE0000-0x0000000076FFF000-memory.dmp

Download

memory/2240-179-0x0000000000090000-0x00000000000BB000-memory.dmp

Download

memory/2240-189-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/2320-246-0x0000000077000000-0x00000000771A9000-memory.dmp

Download

memory/2320-245-0x0000000000170000-0x000000000019B000-memory.dmp

Download

memory/2364-236-0x00000000008D0000-0x00000000008FB000-memory.dmp

Download

memory/2364-238-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/2412-253-0x0000000000330000-0x000000000035B000-memory.dmp

Download

memory/2412-258-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/2412-255-0x0000000077000000-0x00000000771A9000-memory.dmp

Download

memory/2412-257-0x0000000077000000-0x00000000771A9000-memory.dmp

Download

memory/2440-30-0x0000000001170000-0x000000000126C000-memory.dmp

Download

memory/2440-31-0x0000000000880000-0x00000000008E4000-memory.dmp

Download

memory/2440-32-0x00000000006E0000-0x00000000006FA000-memory.dmp

Download

memory/2440-33-0x0000000000740000-0x000000000075C000-memory.dmp

Download

memory/2564-106-0x000000013F780000-0x0000000140CB7000-memory.dmp

Download

memory/2564-18-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/2564-16-0x000000013F780000-0x0000000140CB7000-memory.dmp

Download

memory/2564-20-0x000000013F780000-0x0000000140CB7000-memory.dmp

Download

memory/2564-38-0x000000013F780000-0x0000000140CB7000-memory.dmp

Download

memory/2564-109-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/2564-87-0x000000013F780000-0x0000000140CB7000-memory.dmp

Download

memory/2564-64-0x000000013F780000-0x0000000140CB7000-memory.dmp

Download

memory/2852-241-0x00000000002F0000-0x000000000031B000-memory.dmp

Download

memory/2888-242-0x0000000000150000-0x000000000017B000-memory.dmp

Download

memory/2888-244-0x0000000037040000-0x0000000037050000-memory.dmp

Download

memory/2916-49-0x0000000002550000-0x00000000025D0000-memory.dmp

Download

memory/2916-48-0x0000000002550000-0x00000000025D0000-memory.dmp

Download

memory/2916-46-0x0000000002550000-0x00000000025D0000-memory.dmp

Download

memory/2916-45-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Download

memory/2916-44-0x00000000022D0000-0x00000000022D8000-memory.dmp

Download

memory/2916-43-0x000000001B020000-0x000000001B302000-memory.dmp

Download

memory/2916-50-0x0000000002554000-0x0000000002557000-memory.dmp

Download

memory/2916-52-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Download

memory/2916-47-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Download

memory/2956-249-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Download

memory/2956-247-0x00000000009D0000-0x0000000000A50000-memory.dmp

Download

memory/2956-25-0x0000000000400000-0x000000000141D000-memory.dmp

Download

memory/2956-251-0x00000000009D0000-0x0000000000A50000-memory.dmp

Download

memory/2956-254-0x0000000019B70000-0x0000000019E52000-memory.dmp

Download

memory/2956-0-0x0000000000400000-0x000000000141D000-memory.dmp

Download

memory/2956-15-0x0000000005A30000-0x0000000006F67000-memory.dmp

Download

memory/2956-14-0x0000000005A30000-0x0000000006F67000-memory.dmp

Download

memory/2956-1-0x00000000771F0000-0x00000000771F2000-memory.dmp

Download