Malware Analysis Report

2024-08-06 14:38

Sample ID 240524-t7qhbacc2w
Target 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744
SHA256 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744
Tags
upx modiloader trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744

Threat Level: Known bad

The file 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744 was found to be: Known bad.

Malicious Activity Summary

upx modiloader trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Modiloader family

ModiLoader Second Stage

Executes dropped EXE

UPX packed file

Deletes itself

Loads dropped DLL

Enumerates connected drives

Drops autorun.inf file

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-24 16:42

Signatures

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Modiloader family

modiloader

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-24 16:42

Reported

2024-05-24 16:44

Platform

win7-20240220-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened for modification C:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File created F:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened for modification F:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\_system.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe N/A
File opened for modification C:\Windows\SysWOW64\_system.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2976 set thread context of 2628 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Windows\SysWOW64\calc.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe
PID 2908 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe
PID 2908 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe
PID 2908 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe
PID 2976 wrote to memory of 2628 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Windows\SysWOW64\calc.exe
PID 2976 wrote to memory of 2628 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Windows\SysWOW64\calc.exe
PID 2976 wrote to memory of 2628 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Windows\SysWOW64\calc.exe
PID 2976 wrote to memory of 2628 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Windows\SysWOW64\calc.exe
PID 2976 wrote to memory of 2628 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Windows\SysWOW64\calc.exe
PID 2976 wrote to memory of 2628 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Windows\SysWOW64\calc.exe
PID 2976 wrote to memory of 2680 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 2976 wrote to memory of 2680 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 2976 wrote to memory of 2680 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 2976 wrote to memory of 2680 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 2908 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe

"C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe"

C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe

"C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe"

C:\Windows\SysWOW64\calc.exe

"C:\Windows\system32\calc.exe"

C:\program files\internet explorer\IEXPLORE.EXE

"C:\program files\internet explorer\IEXPLORE.EXE"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""

Network

N/A

Files

memory/2908-0-0x0000000000400000-0x00000000004C6000-memory.dmp

memory/2908-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

F:\system.exe

MD5 4616cf19f415bcc7b8424b9dcaf619bd
SHA1 14dec267c9c1ef3357b613e3288adecd504a2e14
SHA256 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744
SHA512 fa38706b3b5fe436851d82ea0a65e87aa2dfd513136d2368b3ed5ff7b60a542d217e564d251b4aaacb1857b1da54c0bcc20622c158d9524eef7242442f69bf9a

memory/2908-18-0x0000000002EC0000-0x0000000002F86000-memory.dmp

memory/2908-20-0x0000000002EC0000-0x0000000002F86000-memory.dmp

memory/2976-24-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2628-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\ReDelBat.bat

MD5 1ac0db9db1d2c83fd9ab2e9c38520c0c
SHA1 538113f681de521c1a5663b6dee2f368730c73c9
SHA256 ce061b7dbcb9f9afca3fc5a9866185bda80de05cffb9f69355955d44e5fdbda0
SHA512 033cf26f2ac930e42e55300b4f6f8f151aa735277fb7bf61f507284d38e914b90a69c0342731dadf1630ebaecd4dbec55279e8cc0ee0d19e33638f9ff95cd452

memory/2976-39-0x0000000000400000-0x00000000004C6000-memory.dmp

memory/2628-29-0x0000000000400000-0x00000000004C6000-memory.dmp

memory/2908-41-0x0000000000400000-0x00000000004C6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-24 16:42

Reported

2024-05-24 16:44

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened for modification C:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File created F:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File opened for modification F:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\_system.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe N/A
File opened for modification C:\Windows\SysWOW64\_system.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 936 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe
PID 936 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe
PID 936 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe
PID 2984 wrote to memory of 5028 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Windows\SysWOW64\calc.exe
PID 2984 wrote to memory of 5028 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Windows\SysWOW64\calc.exe
PID 2984 wrote to memory of 5028 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\Windows\SysWOW64\calc.exe
PID 2984 wrote to memory of 2736 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 2984 wrote to memory of 2736 N/A C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 936 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Windows\SysWOW64\cmd.exe
PID 936 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Windows\SysWOW64\cmd.exe
PID 936 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe

"C:\Users\Admin\AppData\Local\Temp\94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744.exe"

C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe

"C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.exe"

C:\Windows\SysWOW64\calc.exe

"C:\Windows\system32\calc.exe"

C:\program files\internet explorer\IEXPLORE.EXE

"C:\program files\internet explorer\IEXPLORE.EXE"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 203.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/936-0-0x0000000000400000-0x00000000004C6000-memory.dmp

F:\system.exe

MD5 4616cf19f415bcc7b8424b9dcaf619bd
SHA1 14dec267c9c1ef3357b613e3288adecd504a2e14
SHA256 94968b8b3fb5df470908a62daf1caab26c30a868086eb412610c88d733d16744
SHA512 fa38706b3b5fe436851d82ea0a65e87aa2dfd513136d2368b3ed5ff7b60a542d217e564d251b4aaacb1857b1da54c0bcc20622c158d9524eef7242442f69bf9a

memory/936-11-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

memory/2984-15-0x0000000000400000-0x00000000004C6000-memory.dmp

memory/2984-18-0x00000000007B0000-0x00000000007B1000-memory.dmp

memory/2984-21-0x0000000000400000-0x00000000004C6000-memory.dmp

memory/936-24-0x0000000000400000-0x00000000004C6000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat

MD5 1ac0db9db1d2c83fd9ab2e9c38520c0c
SHA1 538113f681de521c1a5663b6dee2f368730c73c9
SHA256 ce061b7dbcb9f9afca3fc5a9866185bda80de05cffb9f69355955d44e5fdbda0
SHA512 033cf26f2ac930e42e55300b4f6f8f151aa735277fb7bf61f507284d38e914b90a69c0342731dadf1630ebaecd4dbec55279e8cc0ee0d19e33638f9ff95cd452