Malware Analysis Report

2025-06-16 05:08

Sample ID 240313-c7hc9scg58
Target c4c585bbf04113bba793972a6825bcf7
SHA256 4043c471bb101ba5705f35adce9a06603af390b5596fe3a338d5a36e7bd845b8
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4043c471bb101ba5705f35adce9a06603af390b5596fe3a338d5a36e7bd845b8

Threat Level: Known bad

The file c4c585bbf04113bba793972a6825bcf7 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Windows security bypass

Tofsee

Creates new service(s)

Sets service image path in registry

Modifies Windows Firewall

Checks computer location settings

Deletes itself

Executes dropped EXE

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-13 02:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-13 02:42

Reported

2024-03-13 02:46

Platform

win7-20240221-en

Max time kernel

179s

Max time network

197s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\kcpnoqr = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\kcpnoqr\ImagePath = "C:\\Windows\\SysWOW64\\kcpnoqr\\bbytwnew.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2720 set thread context of 1848 N/A C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1740 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 1740 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\netsh.exe
PID 1740 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\netsh.exe
PID 1740 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\netsh.exe
PID 1740 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\netsh.exe
PID 2720 wrote to memory of 1848 N/A C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 1848 N/A C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 1848 N/A C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 1848 N/A C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 1848 N/A C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe C:\Windows\SysWOW64\svchost.exe
PID 2720 wrote to memory of 1848 N/A C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe

"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kcpnoqr\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bbytwnew.exe" C:\Windows\SysWOW64\kcpnoqr\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create kcpnoqr binPath= "C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe /d\"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description kcpnoqr "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start kcpnoqr

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe

C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe /d"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.11.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.109:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 209.85.202.27:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/1740-1-0x00000000032F0000-0x00000000033F0000-memory.dmp

memory/1740-2-0x0000000000220000-0x0000000000233000-memory.dmp

memory/1740-4-0x0000000000400000-0x000000000324C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bbytwnew.exe

MD5 ae92f36000f8fcc03cfb97d696307c37
SHA1 3927115840ae828ef70587266d037e94129ff81e
SHA256 1ecea14da1ee535f5f099727671737789cf99cef02197fdc70f12ca31340609f
SHA512 5f43274a243e846b2f18c9fdcb16fb1a1cd595a16c546d960de0bf044b5d8946270d876a692e1642c29bd73e91d07b274e8a9421de74359f8b29eb10d507cc51

memory/1740-6-0x0000000000400000-0x000000000324C000-memory.dmp

memory/1740-7-0x0000000000220000-0x0000000000233000-memory.dmp

C:\Windows\SysWOW64\kcpnoqr\bbytwnew.exe

MD5 bf3eb5cf46c71ba25e1863d13e5235e7
SHA1 9c2090cea575379b3912254f313ba5c6254bdd25
SHA256 5d88988d775486b01d339fda6659f17cdf604fc0cb7b8cc61ccacb83ef956ba6
SHA512 b37ee2113e5b1acaec5770311408f2e6f4039ea1d99fe387bffe9c6bc51b9c9af2427512f754e6be348d306a66265746b1ae11aad7b8ef47f56f2c236b9a72d3

memory/2720-10-0x00000000033D0000-0x00000000034D0000-memory.dmp

memory/1848-11-0x0000000000080000-0x0000000000095000-memory.dmp

memory/1848-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1848-14-0x0000000000080000-0x0000000000095000-memory.dmp

memory/1848-17-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2720-19-0x0000000000400000-0x000000000324C000-memory.dmp

memory/1848-20-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2720-18-0x0000000000400000-0x000000000324C000-memory.dmp

memory/1848-21-0x0000000000080000-0x0000000000095000-memory.dmp

memory/1848-22-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-13 02:42

Reported

2024-03-13 02:45

Platform

win10v2004-20240226-en

Max time kernel

139s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3680 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 3680 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 3680 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 3680 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 3680 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 3680 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\cmd.exe
PID 3680 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 3680 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 3680 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 3680 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 3680 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 3680 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 3680 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 3680 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 3680 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\sc.exe
PID 3680 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\netsh.exe
PID 3680 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\netsh.exe
PID 3680 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe C:\Windows\SysWOW64\netsh.exe
PID 3208 wrote to memory of 3764 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\cmd.exe
PID 3208 wrote to memory of 3764 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\cmd.exe
PID 3208 wrote to memory of 3764 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\cmd.exe
PID 3208 wrote to memory of 2208 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\cmd.exe
PID 3208 wrote to memory of 2208 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\cmd.exe
PID 3208 wrote to memory of 2208 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\cmd.exe
PID 3208 wrote to memory of 3328 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\sc.exe
PID 3208 wrote to memory of 3328 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\sc.exe
PID 3208 wrote to memory of 3328 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\sc.exe
PID 3208 wrote to memory of 1936 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\sc.exe
PID 3208 wrote to memory of 1936 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\sc.exe
PID 3208 wrote to memory of 1936 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\sc.exe
PID 3208 wrote to memory of 100 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\sc.exe
PID 3208 wrote to memory of 100 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\sc.exe
PID 3208 wrote to memory of 100 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\sc.exe
PID 3208 wrote to memory of 1664 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\netsh.exe
PID 3208 wrote to memory of 1664 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\netsh.exe
PID 3208 wrote to memory of 1664 N/A C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe

"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qoikmqkg\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ttmzlihj.exe" C:\Windows\SysWOW64\qoikmqkg\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create qoikmqkg binPath= "C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe /d\"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description qoikmqkg "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start qoikmqkg

C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe

C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe /d"C:\Users\Admin\AppData\Local\Temp\c4c585bbf04113bba793972a6825bcf7.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zxrtvztp\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Windows\TEMP\ezjmallt.exe" C:\Windows\SysWOW64\zxrtvztp\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create zxrtvztp binPath= "C:\Windows\SysWOW64\zxrtvztp\ezjmallt.exe /d\"C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description zxrtvztp "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start zxrtvztp

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

memory/3680-1-0x0000000003270000-0x0000000003370000-memory.dmp

memory/3680-2-0x0000000004E60000-0x0000000004E73000-memory.dmp

memory/3680-4-0x0000000000400000-0x000000000324C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ttmzlihj.exe

MD5 e6ba87931a8b48ea21c9de63148e0c34
SHA1 7b3c2924c7a6844236588e04bb3c356a86a37090
SHA256 b5e9cbbcb64c8265daaae5847370bf8cdf52b79f0bba79e67381c665b7bb34e2
SHA512 4375eab81c6c8263730dca1419943a93acaca1b66c5b47269fe6da2d0f43306727952b2a29ca4b7e3bd08f60d5b31541f59e0acba7d4a520f4507ee847ab4ba2

C:\Windows\SysWOW64\qoikmqkg\ttmzlihj.exe

MD5 e9f3e1078d58eaaa10d36e6af2374da2
SHA1 87ac6bce1608738eb787bf24bfbfd8054eb19244
SHA256 80062b97df8b2438334fe2e6a3eed0ca89c5b349675b920aaaca1712b1499a5e
SHA512 d7ef67cedb11a2af4061ee41c8dd43a1b287f30812b234c0e3ba27d2d9850127a0e1dc45e97dab1a334cbe4686d26d5d3b47fa6b7e1c45c1e1e82cce3326db4d

memory/3680-7-0x0000000000400000-0x000000000324C000-memory.dmp

memory/3680-9-0x0000000004E60000-0x0000000004E73000-memory.dmp

memory/3208-10-0x0000000003410000-0x0000000003510000-memory.dmp

memory/3208-12-0x0000000000400000-0x000000000324C000-memory.dmp

C:\Windows\TEMP\ezjmallt.exe

MD5 5ded3ce880f7f2b00f08abee23316eff
SHA1 8db925f036c0181754111cb9d51f512c0fc9b2dc
SHA256 ec400c6f4afe3ce0cd22ac7b165ef59fdfa947a63025b4a7e8bc2fd87d96a6ab
SHA512 704b8e22c5a61c63e09d84f3d7877e9d2e8d84a9947e11ad9cfd3e0e739c479c1cba48b9faaccca2ff517fe701ddb494d1d6eaf5204621e1db125733893d4c8b

memory/3208-14-0x0000000000400000-0x000000000324C000-memory.dmp