Malware Analysis Report

2025-06-15 20:08

Sample ID 240515-nb7ttseg94
Target cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics
SHA256 283cdf597f0f1956b187870443ba3354efea512d72a52f56c535c61334c21b6a
Tags
upx bootkit persistence spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

283cdf597f0f1956b187870443ba3354efea512d72a52f56c535c61334c21b6a

Threat Level: Shows suspicious behavior

The file cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx bootkit persistence spyware stealer

UPX packed file

ACProtect 1.3x - 1.4x DLL software

Reads user/profile data of web browsers

Writes to the Master Boot Record (MBR)

Enumerates connected drives

Loads dropped DLL

Executes dropped EXE

Unsigned PE

Program crash

Enumerates physical storage devices

NSIS installer

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 11:14

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win7-20240221-en

Max time kernel

141s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 236

Network

N/A

Files

memory/2292-3-0x0000000010000000-0x0000000010063000-memory.dmp

memory/2292-2-0x0000000010000000-0x0000000010063000-memory.dmp

memory/2292-1-0x0000000010000000-0x0000000010063000-memory.dmp

memory/2292-0-0x0000000010000000-0x0000000010063000-memory.dmp

memory/2292-4-0x0000000010000000-0x0000000010063000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1064 wrote to memory of 3592 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1064 wrote to memory of 3592 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1064 wrote to memory of 3592 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3592 -ip 3592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
BE 88.221.83.216:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 216.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
BE 88.221.83.216:443 www.bing.com tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 udp
N/A 88.221.83.200:443 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win7-20240508-en

Max time kernel

119s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2828 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2828 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2828 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2828 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2828 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2828 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2828 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Network

N/A

Files

memory/2940-0-0x0000000010000000-0x000000001009F000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 552 wrote to memory of 3080 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 552 wrote to memory of 3080 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 552 wrote to memory of 3080 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
NL 23.62.61.72:443 www.bing.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp

Files

memory/3080-0-0x0000000010000000-0x000000001009F000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2116 wrote to memory of 4860 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2116 wrote to memory of 4860 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2116 wrote to memory of 4860 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4860 -ip 4860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
GB 142.250.187.202:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

memory/4860-0-0x0000000075880000-0x0000000075889000-memory.dmp

memory/4860-1-0x0000000075880000-0x0000000075889000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win7-20240508-en

Max time kernel

120s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Network

N/A

Files

memory/2980-0-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2980-2-0x0000000000400000-0x0000000000564000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win10v2004-20240426-en

Max time kernel

131s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
BE 88.221.83.234:443 www.bing.com tcp
US 8.8.8.8:53 234.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
BE 88.221.83.234:443 www.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp

Files

memory/2104-0-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2104-2-0x0000000000400000-0x0000000000564000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win7-20240221-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 224

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win7-20240220-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 224

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win10v2004-20240508-en

Max time kernel

126s

Max time network

134s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 776 wrote to memory of 380 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 776 wrote to memory of 380 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 776 wrote to memory of 380 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 380 -ip 380

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3244,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
BE 2.17.107.104:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 104.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 41.242.123.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win7-20240220-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win7-20240215-en

Max time kernel

142s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2072 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2072 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2072 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2072 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2672 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2620 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2620 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2620 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2620 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2280 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2280 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2280 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2280 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2708 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2708 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2708 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2708 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2672 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1440 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1440 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1440 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1440 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '585550' m 'seoDD' t '0' l 'Default'"

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.freeridegames.com udp
US 104.19.183.100:80 www.freeridegames.com tcp
US 8.8.8.8:53 img.exent.com udp
US 104.16.149.233:80 img.exent.com tcp

Files

\Users\Admin\AppData\Local\Temp\nsi164F.tmp\System.dll

MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

\Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
SHA1 add92b031eb36b26335763780df88bca58636ed7
SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

MD5 2db35d715864b8846f21dc95756171e0
SHA1 ed9030449256bd21e4f041961fb27bbbeddd7fff
SHA256 854bb62475a4b700a7ec49651610d050f1651491d0148c4bd4928b18bdc0436b
SHA512 65b62a0450a60f736af6ac42d6bec252160feac0681cc6319cbd32e76d631a4ea6d206dd62cee5cc00dd22e3de8dbf042024caa22d4288f8b932276f7b93898f

memory/2672-45-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2072-44-0x0000000003580000-0x00000000036E4000-memory.dmp

\Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

MD5 5cf0fba9e8775382233c8e63e52c838a
SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

memory/2672-48-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2672-51-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2672-53-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

MD5 51d301714c7361192d6305f6c46d90d1
SHA1 f546aac6dfab1187228df393e0db2c21e4fee1d0
SHA256 c9245047b86f8359a7f313434b85af481008e8cdf9579fd55aff8b8fbfb5ebcb
SHA512 9b6149c9c099f9cea3d574723d9ff6678d4f91ae7408349738a999d4986ce3cb7b4886f2972f6f1d3b27f7f7453a764f05c50d383f7054234b4ae55437d369b6

memory/2960-65-0x00000000003D0000-0x00000000003D2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 4174cb800274e3c271f7e53ae1b9ae35
SHA1 6ac0ca77eef3b68c8db3349f1ceb0c8083450642
SHA256 d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e
SHA512 c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

memory/2812-75-0x0000000000280000-0x0000000000282000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 cfa86d99a63e54128204fbb4a3c036cf
SHA1 b7ed81965e78e5383aa7ae73c0a6130a5658af38
SHA256 52d4d76788999a904252d8049a335c7e78b789f6ec639fc57d9242c69012db98
SHA512 6fe2576626b5336d90b9a2f10e85e2df4a23f2cd6683f5ed2d51e4735880eac0af91fa3e92bea2f944aed145e74e9372e3dcbebf2974bbb038102557491c38cc

memory/908-86-0x00000000008E0000-0x00000000008E2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 9b793375c56020539f12ee1f1793b480
SHA1 12c73c14d0eb5df529b5d157d6073529fb8dc2e6
SHA256 b5372f6dfb0bacdad7c0c9dfdc53f1224b5c01accabc374ad141c5402d21aba8
SHA512 496eec1aa1b4009ed595ca1752e5382ba3312a77617de101c5338843a101a38d82df8742780852ec200aa4e9e7f1ed9a239f2aab8d6960b466728e9a9162205a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I131J5SI.txt

MD5 bb5cbfae59df24dd68f287e4b1578b4a
SHA1 41249166e72b98c987df868f3a4c28fb64ef25a0
SHA256 ea35ade3193938f8da18a6e7b8963115d534f4fa4010869f0dc4819061203b8c
SHA512 dde49626ac89d8119460524a65d8487a207eb5243650439f745fb745672179ce802f7340123e60a0230a5670ce3b80c1246d4ec525f55623a36253e755076525

memory/788-97-0x00000000001D0000-0x00000000001D2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 c4aa297f6d02e0da61a7e4201f557a7f
SHA1 7f34db9aec9af5554aa84de354b5b42a918ce80d
SHA256 db75832984370a33ca7dbe580f57f9cc65f34d45b4e75f608564410644eafaae
SHA512 3252f8ac8421416bc4d33b71c087fc43c0256e2d7856783fdb74427d76bf6bfae340b7e19ee47d577faa221cb3d2009a7822e6545b5e7912db72027778dfcf69

memory/2672-153-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2072-155-0x0000000003580000-0x00000000036E4000-memory.dmp

memory/2672-156-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-157-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-159-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-161-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-163-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-165-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-167-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-169-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-171-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-173-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-175-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-177-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-179-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2672-181-0x0000000000400000-0x0000000000564000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win10v2004-20240426-en

Max time kernel

129s

Max time network

99s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3972 wrote to memory of 3712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3972 wrote to memory of 3712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3972 wrote to memory of 3712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3712 -ip 3712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 131.253.33.237:443 g.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
BE 88.221.83.210:443 www.bing.com tcp
US 8.8.8.8:53 210.83.221.88.in-addr.arpa udp
BE 88.221.83.193:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 193.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win10v2004-20240508-en

Max time kernel

94s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4220 wrote to memory of 1812 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4220 wrote to memory of 1812 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4220 wrote to memory of 1812 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/1812-0-0x0000000010000000-0x0000000010063000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win7-20240508-en

Max time kernel

122s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1660 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1660 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1660 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1660 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1660 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1660 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1660 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

113s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1964 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 1964 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 1964 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 1728 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4996 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4996 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4996 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2636 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2636 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2636 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4912 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4912 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4912 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4036 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4036 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4036 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3536 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3536 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3536 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4588 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4588 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4588 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2180 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2180 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2180 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4268 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4268 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4268 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4608 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4608 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4608 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1728 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '585550' m 'seoDD' t '0' l 'Default'"

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

ER

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.freeridegames.com udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 104.19.183.100:80 www.freeridegames.com tcp
US 8.8.8.8:53 100.183.19.104.in-addr.arpa udp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsu4509.tmp\System.dll

MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

C:\Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
SHA1 add92b031eb36b26335763780df88bca58636ed7
SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

MD5 2db35d715864b8846f21dc95756171e0
SHA1 ed9030449256bd21e4f041961fb27bbbeddd7fff
SHA256 854bb62475a4b700a7ec49651610d050f1651491d0148c4bd4928b18bdc0436b
SHA512 65b62a0450a60f736af6ac42d6bec252160feac0681cc6319cbd32e76d631a4ea6d206dd62cee5cc00dd22e3de8dbf042024caa22d4288f8b932276f7b93898f

memory/1728-44-0x0000000000400000-0x0000000000564000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

MD5 5cf0fba9e8775382233c8e63e52c838a
SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

memory/1728-47-0x0000000010000000-0x000000001009F000-memory.dmp

memory/1728-50-0x0000000010000000-0x000000001009F000-memory.dmp

memory/1728-52-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

MD5 51d301714c7361192d6305f6c46d90d1
SHA1 f546aac6dfab1187228df393e0db2c21e4fee1d0
SHA256 c9245047b86f8359a7f313434b85af481008e8cdf9579fd55aff8b8fbfb5ebcb
SHA512 9b6149c9c099f9cea3d574723d9ff6678d4f91ae7408349738a999d4986ce3cb7b4886f2972f6f1d3b27f7f7453a764f05c50d383f7054234b4ae55437d369b6

memory/2656-63-0x0000000000290000-0x00000000002CA000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

MD5 4174cb800274e3c271f7e53ae1b9ae35
SHA1 6ac0ca77eef3b68c8db3349f1ceb0c8083450642
SHA256 d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e
SHA512 c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

memory/4248-73-0x00000000008C0000-0x00000000008FA000-memory.dmp

memory/4180-86-0x0000000000E30000-0x0000000000E6A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

MD5 eb0e056909ad45a337557296d926f2c0
SHA1 b89dc64abe23e2c7bad1b434729e399ed54d614a
SHA256 e3d0a1d9debb00d7020be32bc6a87dfd32323976f7f309cece7f3e7f0a41b177
SHA512 43c8ab7d267d8accabb1c804ff7880f274bf3b72fdc0cbef707c598e4c7973d139c9171e2c8a0e663f5f8ee34f5a8cee2b0394d5dfc2cad591d807e1f4981615

memory/4404-95-0x0000000000E50000-0x0000000000E8A000-memory.dmp

memory/4240-114-0x00000000004D0000-0x000000000050A000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 adbebb97443961287565177847869c8e
SHA1 de16efd6ea631ca327af35fdee69e171865d412e
SHA256 e7018e43ae43cc1395aa740cf64d717ad5206accd1c7242f74b0032298d56d63
SHA512 41d5addd12cdad24b2f18802a6e73740eea170e749a361d514903a92c33baab924941dfbe7352bf9a38c09493c9233a4aff16e9f6a541f19d949ff094a67a464

memory/860-130-0x00000000003D0000-0x000000000040A000-memory.dmp

memory/2684-141-0x0000000000D80000-0x0000000000DBA000-memory.dmp

memory/3844-148-0x0000000000AC0000-0x0000000000AFA000-memory.dmp

memory/1728-178-0x0000000000400000-0x0000000000564000-memory.dmp

memory/1728-179-0x0000000010000000-0x000000001009F000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-15 11:14

Reported

2024-05-15 11:17

Platform

win7-20240419-en

Max time kernel

140s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 220

Network

N/A

Files

memory/1340-0-0x0000000075380000-0x0000000075389000-memory.dmp

memory/1340-1-0x0000000075390000-0x0000000075399000-memory.dmp

memory/1340-2-0x0000000075380000-0x0000000075389000-memory.dmp

memory/1340-5-0x0000000075380000-0x0000000075389000-memory.dmp

memory/1340-6-0x0000000075380000-0x0000000075389000-memory.dmp