Malware Analysis Report

2024-09-22 07:45

Sample ID 240602-qhsplaea86
Target IDUX.exe
SHA256 a2295f8724805d78c537dd0750a0e777534013d5aad7472923e56e2b63135243
Tags
rat default asyncrat execution ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a2295f8724805d78c537dd0750a0e777534013d5aad7472923e56e2b63135243

Threat Level: Known bad

The file IDUX.exe was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat execution ransomware

AsyncRat

Asyncrat family

Async RAT payload

Async RAT payload

Renames multiple (1280) files with added filename extension

Executes dropped EXE

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Modifies registry class

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-02 13:16

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 13:16

Reported

2024-06-02 13:18

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\IDUX.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Renames multiple (1280) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\IDUX.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-100_contrast-white.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-24_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-150.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MotionController_Pair.jpg C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-200.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\CottonCandy.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-96.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\YahooPromoTile.scale-200.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-20_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FlagToastQuickAction.scale-80.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\SmallTile.scale-125.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\SmallTile.scale-125.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36_altform-lightunplated.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-200.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-100.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-60_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-36.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailBadge.scale-100.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ast.txt C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\LargeTile.scale-125.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-72.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-100.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-125_contrast-black.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockMedTile.contrast-white_scale-125.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-200.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-100.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-400_contrast-white.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-200_contrast-black.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Protocol.xml C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-125.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\152.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-30_altform-lightunplated.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square44x44Logo.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-150.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.scale-100.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-125.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-30.png C:\Users\Admin\AppData\Roaming\IDUX.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4304 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe C:\Windows\System32\cmd.exe
PID 4304 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe C:\Windows\System32\cmd.exe
PID 4304 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe C:\Windows\system32\cmd.exe
PID 4304 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe C:\Windows\system32\cmd.exe
PID 5080 wrote to memory of 3600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 5080 wrote to memory of 3600 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2216 wrote to memory of 1332 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2216 wrote to memory of 1332 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 5080 wrote to memory of 4356 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\IDUX.exe
PID 5080 wrote to memory of 4356 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\IDUX.exe
PID 4356 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\IDUX.exe C:\Windows\System32\cmd.exe
PID 4356 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\IDUX.exe C:\Windows\System32\cmd.exe
PID 1136 wrote to memory of 4160 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1136 wrote to memory of 4160 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\IDUX.exe

"C:\Users\Admin\AppData\Local\Temp\IDUX.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "IDUX" /tr '"C:\Users\Admin\AppData\Roaming\IDUX.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4759.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "IDUX" /tr '"C:\Users\Admin\AppData\Roaming\IDUX.exe"'

C:\Users\Admin\AppData\Roaming\IDUX.exe

"C:\Users\Admin\AppData\Roaming\IDUX.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\edhjzp.anarh"' & exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\edhjzp.anarh"'

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 true-foot.gl.at.ply.gg udp
US 147.185.221.20:7416 true-foot.gl.at.ply.gg tcp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 147.185.221.20:7416 true-foot.gl.at.ply.gg tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 147.185.221.20:7416 true-foot.gl.at.ply.gg tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 147.185.221.20:7416 true-foot.gl.at.ply.gg tcp
US 147.185.221.20:7416 true-foot.gl.at.ply.gg tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 147.185.221.20:7416 true-foot.gl.at.ply.gg tcp
US 147.185.221.20:7416 true-foot.gl.at.ply.gg tcp

Files

memory/4304-0-0x0000000000E30000-0x0000000000E46000-memory.dmp

memory/4304-1-0x00007FF98D983000-0x00007FF98D985000-memory.dmp

memory/4304-2-0x00007FF98D980000-0x00007FF98E441000-memory.dmp

memory/4304-3-0x00007FF98D980000-0x00007FF98E441000-memory.dmp

memory/4304-8-0x00007FF98D980000-0x00007FF98E441000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4759.tmp.bat

MD5 c8929591a3af2b1b0f75e1343350c970
SHA1 b2e4dc8ea9ec0985df9cd50a8b92454382f7e291
SHA256 6478cac7796f2aaa9cae0613fd9ffe93e783cbc60f1009a1712d45938cc5fa9c
SHA512 5e17c13f4fdb6be756e197847705e15d7a760bcb25dee4b307f141580c844ce667336d71892c8c8f4b276c872d01c48b7ef6a202380c8e297a891581003db220

C:\Users\Admin\AppData\Roaming\IDUX.exe

MD5 0ee060baaff3a8bca5b128a48c7fae05
SHA1 6469a7119a4a675a0ff228a76a59c9125a19f6a9
SHA256 a2295f8724805d78c537dd0750a0e777534013d5aad7472923e56e2b63135243
SHA512 cceef179d14892af12e8e53b6b8ed2569c6486a8b5447d17add393e1341bff698d1cc8a01f773e6f36369aaee7492ac8967242fa4fb0c2e9564102726db6caf0

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IDUX.exe.log

MD5 d58f949aad7df2e7b55248bfdfc6e1b8
SHA1 6713cad396b5808b66ede2dd9b169e00d5e5018f
SHA256 5e1611e4d915fd9759825811fa4463f09172889f85889a2942be1561948fab8a
SHA512 bdddb838108c4f3f0a7737703cbde935fe26aaea97459bb099c4c773c0789997283d7f20ac7ea4ac2aedef23515afc0b251b5b461aa12d3b7a60846b87b26e38

memory/4356-16-0x000000001CF20000-0x000000001CF96000-memory.dmp

memory/4356-17-0x000000001CFA0000-0x000000001D46C000-memory.dmp

memory/4356-18-0x000000001B250000-0x000000001B26E000-memory.dmp

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 ecc8fdef06696bc77d9dd3ff5058605c
SHA1 133eb4df381f89a2bb2dae7dc6515514cfae3fb6
SHA256 aa4f26d01d4c5417065278e9a6ce36cf2ba0acf045c3c608f033fb13caadd6c2
SHA512 9de98dd3af50512d2c8c317c645c96649079345b82b82cc14a31c63666292d9e0138c556eea26b9af653d1ffadb973f2f384249457c07ea27d129a6172b76e7b

memory/4356-609-0x000000001D670000-0x000000001DA78000-memory.dmp

C:\Program Files\Java\jre-1.8\LICENSE

MD5 e87cd34543f0c560c90844404da7b27a
SHA1 b8884a123192cbd6e81c859ad2413d3c95732bbb
SHA256 d1cc5eebdc269b4400f5e2e7f8d92f01e1503ae1bd422ebbf1a126896f453101
SHA512 d87d37db094c91b04e9cb753d69116011139a21717c14c44d04e9233bf45cfda613622e8b2a5c7623e1ff739e366c6e93c75295457484c9addce679b9d27358a

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 3231e1e0837ebf7da6ef2ab9bf82b4e4
SHA1 92ac1021db841457a2e9e9b23b4a333a5b5629ea
SHA256 be3c92768b1d2178fc5e23c032ea44d265447b02e8592cccb7dfb53056fa5261
SHA512 81c2ebea3b95beff5555e2aaa34ae9f207c7c0c71931480cca6171b699cb868d6620c7b9eb2c450af1ecc4895507eb97bcdf85a5c653060ce0f6797add2a86a5

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 6ce83c370be27561236aad3c8e3195d9
SHA1 7449902a3cd9d5a6813b16e127a2585e0418cc21
SHA256 7bcf409e26aaebc23b53d7581083bd51fef05a9dfef218564d6d7367c11dd8f7
SHA512 4c75772c709abe144a9ee34522c5dba4a8b2e471c2efb9e696e834faf226d4d0e1235d86f7a71eba3aea91bcc1f66e1dfdb1eb49a9307a57bdd3283efdc0ece2

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 607463aea81329c740892e45ac4f3cf0
SHA1 bed3fc8b3a7c1cbaa0e94625bb5a4818caf6bd5c
SHA256 dc09f026e44bb7ee6df99f543feb5b6feba663751e9aae20c0c01337ebbb1bff
SHA512 f0caf05df03ad6acd916d2086a269c3e1c14e30e8cf36a4ad6cc2cf33c98a3163a96c13e3a2c7cb81021023e2434681d4219892eee79a4345994220bc82b0cbd

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 34f1ea13cacfa20c7f857e27149458a1
SHA1 0156353ec333c61ac20dce87370b6459d0058631
SHA256 9649d05f3bc412efb0a9ba23532cde916df02fa08590faa63886f919b225cd84
SHA512 c17e931bde043d4efd79e52407c02bb211a2ded11c75fc8679ee9ef41f5c3aee6a69d49f641db87cb693df4c86f44eb42e04c37c83d69c5ce3923a5b1065e3b5

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 6e6c06953a868836529048593996a979
SHA1 c68331f58f8ac2d6507873dd24909ad048b8edca
SHA256 b9055dd7f5c81a030120632bcd37b9483f6ad83002cb16579f992441ed4fff86
SHA512 857acc9581c3a6a938fb4a2b38eebf2fc8f3916572805a8e7c67e9cf5479c4b4a702602f99589300abdaeb3e25b5e525740501185fed1fecd7cb70d470ddf4f6

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 b9b104c20898aa6ff8e4b2c49a6243e5
SHA1 dce814df89a998beb844187c27e3bd5ae1b81fc3
SHA256 54d2412ba571662026a2fc11bca4439df1b4cffb3dac90907cde3969c62e3034
SHA512 e6f8791648d1551e0cb61d15b8f4831acf7a34609e0a3c78c3dddd775124d2035f15fffb48332d8f1d5835172a183932f598286db2e4e3f498abf48c8d887f9d

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 63f7b8e198092a0431b53921b9c0b50b
SHA1 d66222411b9f624e1cf3806769383a140ec5b0b9
SHA256 5f85f2bfd60b5ff3c5826d56e23a5f1d773bf0d5c80f4aae259fdb82b345103f
SHA512 6720f9afeeb70190e3038b4b30025fd0df4d9d952b2c6ed6df50f86ba162a2c63bab2e00d58788ef761922e08413b71c4d2fe00d79303a983fe3e385fec5a7c8

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 fe5243228e957f7db28270670b29765e
SHA1 65bebf01727cbea58b63183f533a0184cb3dc266
SHA256 34a269b9a162bae7782642d1a175870de706d08ff50744901442e6f3169ca091
SHA512 6fa5c51b3b0b5d72c4368596e1f3535522811a244ad940e66dd61d92bb0d00d5e1c9f568fdbc403b7fea8fcc511ca6f4bd874dc03d4ec3b66aa01eafc7a744f8

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 0946f1e549457cdf4b72074263276280
SHA1 3bb15c151c21688de0a728250ab843b938bab58c
SHA256 993c548b0f5e4481337b04fdfd402b32a51f74c4dd1e0cd3c327fcaa4e222744
SHA512 c6d5745c1fc5e48058316a1981267d01a16194ca1e4d512afb0ce68d7ec8522cb1f32cff02a60db3fa9e08eb3f04dbb62e70279b4c033fadb92e451c2f333a73

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 59958e9b9515eb06f0efb9d95ba57859
SHA1 44b754cf2c36ed35af0489bf4df3203e9771914e
SHA256 e867cabeddaff1dbb7d7b0aa223aaf62c31840bbd5e29b8e1318eb527d8b22e6
SHA512 dd474be057f53a01abf843bb2e2b173859ebaa00a54ccc503b7b48320c5b75783e57310c50ab18315f803fc9b401d4748277921f5155d52d05a51abfdd3b9e21

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 a34af69fc5e7ccede4cd907e11363034
SHA1 8a2d1432e31c6bcad221ea32941d875fcfa26338
SHA256 516805bfcb36b36e0884975cfd4e276c72520b8969485038368deae9f4048db2
SHA512 1c2b64f96537c6f0516c5bdb4975f528c6b5142434adb08aad86fd56bca01861254da8cfebac8890b763d1972212abee50d63af81363c322917d1ac85176fc80

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 260b208a373bd2db74d6e15440f9286e
SHA1 a88de1b52f5483e071280a757f2c69677e4da166
SHA256 9425c9a5e75388892f1ca8a5642a3e9a3ebbcc20bc14cb2ee495f8d8f6ea6114
SHA512 1d91489cb22b85c3d69dd0761dc443cc9aecbd7b1bb21f3d68f14f2be9443c0b8765d84982d38a3a9395281a24ab55aaed01a7b6194f9804a816f345e7f869cc

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 4fd47b84047aa400d7abe4892ff7763a
SHA1 ff0128f1c2bbd8223ed71e0379e0a6285689c740
SHA256 83b31f99fc4120368ea248f3736b786456dc287d7476b45ed45ff0373c8ea0c8
SHA512 dfc63f43cb8535215db5086941f293c508c6c78e0c99877581722ede140152e5c992caf41c22233898cf38541804b8a97c7321ba89a20c345fe80a686b201bfe

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 11d1c08700dec723a7d042b71a2ecc2c
SHA1 4d9b2e6efb3e6293e39bac598515a5bfb7f1fb22
SHA256 97577272e6498b339502ce0c6864d224c99d6bacf2fc1285012fe955d1bce31b
SHA512 b61c7702c03ea5746bb8377cb560110eb8d0c85402c80b9efb47ac8ba99b2844bdca8156adef3bc5c7421984fe99d672ce12b0f31b1630d6fddeb0c764fc1baa

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 0f9d9efa856fe9a711caa678c51cf112
SHA1 c302b474c01f2186d65827ed853c852e0ce60e38
SHA256 8e0140181121f269d91401bb12f5ff7966d34fb885582204a15ddee4ae655baf
SHA512 7e503bcdc681a63b70da2e31c55a1aa15666d33c4229eb14b37ab7f21dada9c90a2ad17fa648184f5f5508c274557c4f52e95e9f679e6146aa6453b5930782c1

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 1f4f9469949bd113e4c421b41a2e5c66
SHA1 fa893447ebe9c3b0986eaac72879e6a620641517
SHA256 8d6630b9ec242e9b5766477e873a49d789e989ee1213558726d4096cc00c624f
SHA512 fd98df806e8fa0404d94ea797810f129db157012576926430f1b06d824513a163c2382d7df56ee5fccb56ca115f41a0232ecc41825ac60e847ed831434fc9277

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 749cc27c07e875725c76690b6018706c
SHA1 e6f6ae3affe5fc1fe3764fb7247362f55ea10d5b
SHA256 f4004dfa327ec6a8939f2cf1b664328f7638d8263a5217b09ca4e8928b9f8b03
SHA512 6f044a8d22eabcc28a36bad53dae0ddaa88671642ae175f07fe02f1fafc5511c14c97c808c39888516f706533921cdf700956793800a9386bf06fbc6e834782d

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 f8b61abf7e6de78ac95821474f15aed4
SHA1 e92a42fa4c398bff74190ed806c7e606e56faf0b
SHA256 113a950d86c1e0e8ebad1a633a01d98b63fb4529f553740159f50e9beee7a7fc
SHA512 0de3d89468244f8ced34f297bbb3a03658240d23af7bff042d8a176a1a6caab6f9801a5225cb1e9c4d34dbf075de4ebea4ee97e598f0564366248a93e372f2c4

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 509f586ddf5e8fd88ea71e3bb94ad063
SHA1 d8bb1d79c46c3fde3cbdb379b80aa8fb2071c1e8
SHA256 8d0afd9b4ac3e17d53b5d4815b0d4f03394e59281ce2aec3502c8f81db7c631e
SHA512 2cef4f39d0cadfc4949809cb841307bce44e641833b764ffcab4574f04ef8c2c93a6e99bdd748f7008b80bbdde756d6c5eb8ddfd65de05e99765167df1964135

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 a00f0b264447480544948960e31a2447
SHA1 2c0cf688ed78fb34eeb653eecffc4fc9814498f6
SHA256 0f272c949ae861329def4568e035392234c5c50c2657941789894bedfcd5384c
SHA512 3a4581a186a1ef3890adc2a8e6dae9478836b14493e23176ecdf3e89c94c5bca3af9cf6f1d0ef8062e38d160c993bb8368c76681c773ef3f5c5a22822ec6fa49

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 bd5fe87a833e48fd285b795e808589d9
SHA1 1f95885d7478c1637b68967569bf0f95ad4915ea
SHA256 275885be46298abd38c77ff9c69b41b892cdee3c0f3c553e9d959d2294bdbfec
SHA512 f0ebd263ceae971430d98358112263d7447b97081e555b5359bd1aba8bb57b64ebf993054b8c1bfc70717ccf595f58b53a632f361f154c7a63ab29bf85a16647

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.ا̘͜ل̬͓͖̘̜̀ͅف̹̙̖͈̣̀و̠͕͖̀ا̛̲ل̸̘̺ف̶̹و͚̖̗̙̝ض̨͇̮͓̠̠ͅى̹̗̯͡ض̢ى̳̬-aj219sj1Uain

MD5 faea9e6116e7ea340dad02a5976f953a
SHA1 7abac90209d22cc10161af64c29288f44c1a018d
SHA256 e46ec92b9e1e1ac5a93df9542634fc9a2f7cf166456fdebb72d1b8f5d1a24646
SHA512 3b88bfe934359e50000d26cba6a3cba8987a64e448f4527c221e76a48479d994a1b41690e219596156745670335309ff45e556f5741d23699fdb25f0f738894a

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 5375188d8f39ee3f28b3ef9db33cd9d1
SHA1 5077fe43959e1981f040ce85c858748874b1b9bc
SHA256 c832681fa5ad3c754fbdddee9e0c45d2825108391d17179f93e48e0f798f8860
SHA512 ce609f3e5e87c50fef163cb9f34c2e5733f72b585afd52af885d6d776b07ffac254a18155fcf79ad4246170d9c804728cd26cbb1ad160fd02f4d626350da00d9

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 d6dcd971480189f8a5daf59dc0866f20
SHA1 d55e23ef484287fa42fb7936a921b9a5cdb9c1b6
SHA256 57f379a7211029e53dedbc3351b81cbe3cf66dfd80f22111c36b98ce63324f52
SHA512 ddf1354cb79063448cc85abbdd4f6fd8b009b2757a0ffe397414f48c6ef27e023794eef5a57a23d1752120582c0cb10080bfcef5910bbd7946f48e48a8de5026

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 ab5bc05eab7eb31be78c14728b108503
SHA1 cfa255dd08361c13afb757eafb18deaa13140e3a
SHA256 f3a918e22d48991b5760c96a75dc78c567044b8a1edbd7c0677f954ec6554f1a
SHA512 cdef33ec728e005008085370a7532e1a2a045bdc7e7cc26bf92c920cdc5988d55201200f5d18ca7100e16caa8f9d7c3780371c3017ebb320a00ad750eab63919

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 a1fa921b9dfda3cf84d8ded93639a232
SHA1 11fddac76f8e2ddd2e276b36231014508a3a392d
SHA256 aa906568ca02a76ae2e5b2b2f4a30ee4a2faf0adf41dcc01eb06c6f5bd5620f1
SHA512 4abae55744efce20f67d4cceecfbf9568969e9d79cfac7c5c2d540ed5120621b33fbe4a0297ed59ff8050a836115fbc60c2f2835a78d15c4942614fdd7b64b97

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 1a08f51e6de894db26378465a1b41d03
SHA1 5c75490376cb23afcb41f218b7df17e88effc73e
SHA256 64c30c0849f431c8272dc6fba8081638abe575defef2059ea5ddeb5289c11bd5
SHA512 e34b84293e2fb64da08d9af7ef94eb9abcb6115f0442b311d4d60924ef9d3fd39ff03ed8aa2f6b7f97d4f4aeaf5752accf65753b2fc13fa466aa5b787331a1af

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 5058a783e5556a35c2719e594aa0f4f0
SHA1 10a06c6552a0ea3638cf3db8030a549bb6823bcf
SHA256 58523f7b7e8a3a5ba0477d0f15f6989d8f77e623e4da946075c828bac2388d03
SHA512 9a0fe8952e9bc16bf24acd6d31c0da98919a696cda08ebaefc2044c562d202798dc8f0d96fafcee5e51421e5fcaefc2337f76ba29c3f89080d16a2c8e7d8edc3

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 31a2974d3bf40b6411c2c7ab55e5e931
SHA1 2ec379022f88047a30ed40259a9ed302899ec966
SHA256 6af6638b31075cb0cc04427001c4f8983ec716e51095c44205e56f6e3753ea45
SHA512 98e121178b4314fb45c9c1734ef53b67966ffb1c4a43a2a5c59b7ce2e2d4242df3ee33131406602c227c7d3900f2084542f6bb5cbda4d028eafc9b6496ad2712

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 49c758cf47e1c91f18b42d113202f7eb
SHA1 0e1ae841f429b197225aad962747191838d4cc0d
SHA256 b6098926bf1b351395f97bc4557d56da7f448f453017848f0e33822e20b1f72d
SHA512 b561948cd0ec950d6717641e36ee9a0067c8424778cff1d8986c072ef2b15e0590870eac287a4685cd5347c67d323f1e3fcb7765f47914f13cf85bbdf55390d8

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 4f8eedda2c880b5f545a52f5b50f6900
SHA1 6bd5e7132857e0d9cd8134cdb0418e8f3cabcce2
SHA256 95becec0896497e3afa92229a1aaa95c3f363d73a3aae5bef8bc80284e8a5578
SHA512 1a31d8df65c8fcdf253ce57ba3c9bcb8109b604480a810bd4a31bd7263a4fec8d8e7cb7c46cbf88185824a90799ff0b4de4e35ef9fa8653cf85a4690c79b62a7

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 ea9df8ce88c0ce17b26dc885e04ac442
SHA1 d0873f77040cd8d92d6cb228585e85ba71fd1cb9
SHA256 757a8d3fe3d6aa24a1c36c19dc16e3126ed393c01dd9bc26799a5bfc8c4564ca
SHA512 620a25e290117f1269d597f4c6b606d9e164c1990e21a8eb032704b73603e665bfff21cf8b12bf318a0dc35c4a20f024a4fc507ca58b368f5789d0b14aa798de

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 bc8af80f17d4dd94a731f5c05059068e
SHA1 0f9ac513abf71ffd9cb8bb795daeacb8d982db9a
SHA256 114c217f0f67946b6dd4588bd29290b60b41100e79cc14bdfbbb4ad0fd10dec6
SHA512 8ed1aca123c9e675cbc03ccc2df95b7e88d74c8a64013838639222ec8031299d470a36fd123e2f6eb54d36096bdbb5f781dec2c1872fd9dd73acba38ad9833f1

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 6ad83c1fb5a92219b42f05ff81d7e6c2
SHA1 2e445fc5c3b85c68020ca335e93d7fb18e37e2e6
SHA256 f96345855b7d7242e9c4788e3e0a3732052987c6c2f2b31e5154adf15bc594df
SHA512 701d8519e9471a589495fd37f770fcba5d66590aea241c9cc3e2e6ab0d8b136c130b8b6c4c27f023a45a0a07a7af2ae81be3e91570b3bc5d58b15d11c125b3f4

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 b3572d62dc0c7b3401913007b2c82836
SHA1 6195247070942ddeac037e7a8012596c60086801
SHA256 d72e34f2f798b3a00df3a2b2a08ede3599a6a849c8bc64d145db2e8367514a8e
SHA512 ba56de116db17fffca59d8abc84d75d7fbc185173a8ad537a9c39be37f5f157186549a0e153e582a2299a488ceee5165fc82254fe637495eb1f8ce1d147df10b

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 228ca36e97fffc1f8b38343168c52516
SHA1 dcea0fe389100d4ac3184ba0c731683d339eec12
SHA256 f9556b14529925a661a244125ec76311513a996d8b0ff52c240a9eb3535f4574
SHA512 b9097593ada2e1833eba1be5f29be5ea7586a9f37ed5f0326ff0390432b1f58a5c7aeb50e3ee538662cfd46105e044ac893b1c8143a4c2dbfa8c81062940644a

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 f2d41daa6da0f81d9c6172d18dadcd11
SHA1 25980fb269c0e1cc4d4cec330bdb97aa5e68b8c5
SHA256 f897d388b2b3354c0a572b8e7205761fc1d57ccff79d910d273002a4b105f778
SHA512 cf1ba54044e5a25cc74649fb07756b26ee08353884de6a9abf04c4925266ca70df37a4c07a14f4c1c7a90d215767b5b027d44da4540b4b84cc92a29bc25b572b

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 3188bbd9ceb587780331015e5902230d
SHA1 87b60fbe26855508f0373d2df548e1ca7140436f
SHA256 95b01a23fac4ee02f6d7593e6f45023a3c3dea8f59c3690394ebe60be1887f49
SHA512 431e7961e2e38510e21a1cd051ca1bba928018bb985f3b2891c70412d15ec6a8a1d25cb7f25b49c16da34bbce82b902ace2c94ee34e18f85633b1b9c45f62cbd

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 a5e03e5f32de38b50418b19883f32fd6
SHA1 e2195e99cc9246308009dbc4c65a74aab0324cc2
SHA256 85cb556abd5a6e3498a0b3c2e1911471a7cd11c5bcbfbe2f3dd23cfeb6d0919f
SHA512 23ce3e7e4f37b7aa50d09606cffc0c59f3761d359607ac11ce332f0fa7ae920412767d166e1835eaa71cb20e0a06cc4d2ef935360f93df6d680b7e974fa9ffb0

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 a661c9837c32475bd86b36be18eefe09
SHA1 4d159c22f1ed98ff0b3714211f860e18ce0d9a23
SHA256 fe7649ae4e0ecb52ae44b25747614e5bc334b9e3a23009ce6a991c15ce596604
SHA512 863dba62f6328f5021966003a41888d38b67a8cfdc2f310534209ed4e9fcbf763b53f5213c69f57909f03d01c684dc186b4492a79c57fa29ffbe269ad0dedae9

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

MD5 09b6c0cbeccb3d124082495febe37183
SHA1 f6199e6706d98ebecdf007d114445e4c210e9803
SHA256 3855c3e44c330b3c7b58ddee57d3faae61d17dbb8fdadf053a26b10434c0ea44
SHA512 2ca1ff9b45042aa2801aa5a712eafa613e0d48b7159459ab2cdb7b04835cf7c7d992ec5f57a278dd523ff9eeb1ff30595c5eda384c38364ab005ebec6694ccb5

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

MD5 3226bd433ca83ea6a987af7a06b592a3
SHA1 8b7423b85abe2430a3729b60563a4a796f0eeebd
SHA256 c0b797f4532b898e8e16d497f463a3c3dadaa0f92097552d7997a106a1da9487
SHA512 e7418fd6cb53d745945cb679ae4a3c652fc46f601167d3cd5e73c84f3759fb7dc4ab27719f736f1ce081ea55c931c9dbff05ded5dafcbf3c5d41449703e5e7b5

memory/4356-3959-0x000000001AB10000-0x000000001AB42000-memory.dmp

memory/4160-3970-0x00000270F0240000-0x00000270F0262000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5ckufr3.a1n.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\edhjzp.anarh

MD5 382c8ea16ed9a48cce60db2ffd857c0a
SHA1 64d114ec25a44ed3a234fbdbd0bf01f452e5a0d4
SHA256 5edd0a772bb805b863f1e6ea3c45aae6f2d86c297283eee24397cf32df7ebd91
SHA512 5d45581ac20daa2651b105369a4b9795c28197e50d8d0240ac57a64b47965d7ed14fdf2363e22ce7768e0f9c219cc00d839d731303f17fc0e271e358def1beb6

C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml

MD5 6a1aa42fdc6ef4f8987a5c503b828425
SHA1 145a8b69291a6f1e0ea5d6625638bea497b876f5
SHA256 d9ca4c9c4dfb22c3745add337cc862cda05271e123241485ace74579a154da45
SHA512 61dddd240b1e26197f1e368131558749d1ec8f59e9e48c527e688bebb683231d7f4de64846935828675baa5ae3be903942eb86366951534ac97abd5926d89f10

C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO

MD5 f8e6b5e8edeb6e1e457756d4ea04921a
SHA1 9e50306dac3f36b68076148781152b2c5c3f8b87
SHA256 91e33df0b6ddbe08d23444a3def5a6a5e12227e855825aac3d3f7e90bd5824ee
SHA512 d6329ba6bcee8cf51f31e7055f2d3151b7e4f3871d03f5f4a1fa723bae9ce11100f77a5b106d6e3b63f355ecbb21c5ec918c1ad0321da05003553f67b2d1508f

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 a8dd760a6faa95160cfa6a2255d69099
SHA1 e12b9cfb95ff685dff0d053a00bb8b630ef393ee
SHA256 8c0499f49c760f66e31433b6dbd7c4db43acbf8591f3cc7270e3fccd353c7da1
SHA512 4e5dced8b63849c43b998b19842cca17f1fd7dc5ef1def42a512cd12a6a4bbeda624fdb7f1799fcf0f82f6fa1e78042cb3779ee1a58256825f0744539813ab28

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 f4af4163bf72c8eab67fea701ebf45d9
SHA1 bba59d663175ed9009143b9b2c534fe90f47341a
SHA256 4aa16c5310a49227f3f8c6a2f8a90b5067c4e87275d335197e582de72de65288
SHA512 acff111dc45533894bde99de635060bd7639a7007c9a192e1ffda8ec60f6f30b6a3efc31cf35c896d36a09adbca025cda63cd2f5f9440f0cd2473219f2ba7bed

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\graph.ico

MD5 c9e953622ec850b37496043777d4d207
SHA1 7c7c0a022814a43b2df8ffebeb02cdf420ce87c7
SHA256 92e44a0a987d6985e2aa9ac8b1b9635b9b5ce9ae79971f85fa734cb2fb58e6ff
SHA512 b5b473f8ae454eb043ada50a9af50a69f8f3344c684a9f26b129b251785eed958ab60b2bb19b24b1b6705d17b2ef7af62ac1d5415b3c39014d984c85a3ade9ad

C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo

MD5 c58938554e7c2259b1706ad111c30c93
SHA1 2584e22eea84c5e2d60972ede47e6af706d7c28f
SHA256 010d32fab775382f9242abe6e86efe7e098bf6e45e153623affaa22444afcac7
SHA512 9f691fe346233647d66d52ee893a951c9cb1a98db2050a756832a508f0ff6216dffc075f3459bc905c767fb2dd9f5087f5843104b2c301b3dd27ec0a5b88044f

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo

MD5 fd7f3d7f7cd4e98c64e23e9c0716473a
SHA1 4bcb4c4e3d48f900738bb18c0161ec2add7d77cd
SHA256 f6a81dc1499699d527a22ddfdd8a73b4081e5c597fc11740b4292f07ecf460a9
SHA512 a795f67da14f871fd0129d03291592286b6d39ddd5a3b7f32c0349655e0d131a07dcc9c3549c6f973ee6e4b3a0c55ae41ff7f820f1fc138d9f207ddfa99e799b

C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo

MD5 71b8d5f4f53e30257d5723c3ddecc6c6
SHA1 7bd7e6293fd51170d71d3c339f4b783f10f112c7
SHA256 98b361cef7048f22b9c6086bab8d2e9ba4f34d1853dacf25e88878876da7fb1b
SHA512 081bce86ab38527929527717d51927c95b8183685ade6438f606e20bf3b4daaded004a8ea5b5e8f17afc4abd175f539c857c3b05d7a58b24453dc8295951dccb

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5 905233135b52ee5d7e8277b0f4564ac5
SHA1 750f1cab3776553540a33d4c200cf53d63b6ab7e
SHA256 92d484910023680e3dcdbdc5db1a3f5dc07d8eaae68f39ad32052edcb7395337
SHA512 2f610658217695432cfc167d783c83ef2fa9fb10561b3b8b395d5881f0d6adb14701abd30f086ac670ae069c52a34b169e5186b5669e2692656f0460783b3566

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo

MD5 5ee8a787797375ca5617d58d0c083292
SHA1 aff14fc61b0d9c8bf714695aa1d92ef3fce1d3c0
SHA256 955abe87e475b3c8b4ce3a9bab4aa972ce1832b4e8f0a2fe82e22d992eb0cb3a
SHA512 c0824e955736aab18a7797f49ebf7ee6a8a5f4687f727aaa188eedb0d3e7bbfc131e43035554f1f06d33a7a301f2d7151352e9665c4c13aea4a66cac6c45760c

C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo

MD5 cfb9ae945ca2f6d43012ebe969e2820f
SHA1 e5344c9827ea3a4aaa79ad8f4d69d80ce185396a
SHA256 f332477e995c07060c1e7dc6d540abe7f7a41cb8b445ec6d29f45f6b3c57d4ff
SHA512 8bde8b144619810909241b7b382f0a26ea0ef6254013b6a709051adf8eb2c0b0937894c189bf4cdd4fcbf1bfacf792d59b6427d52ca60eb027f7fa82d09e482e

memory/4356-8084-0x000000001B9E0000-0x000000001BA04000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 13:16

Reported

2024-06-02 13:18

Platform

win11-20240508-en

Max time kernel

150s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\IDUX.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IDUX.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\IDUX.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\IDUX.exe

"C:\Users\Admin\AppData\Local\Temp\IDUX.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "IDUX" /tr '"C:\Users\Admin\AppData\Roaming\IDUX.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5757.tmp.bat""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "IDUX" /tr '"C:\Users\Admin\AppData\Roaming\IDUX.exe"'

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\IDUX.exe

"C:\Users\Admin\AppData\Roaming\IDUX.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 true-foot.gl.at.ply.gg udp
US 147.185.221.20:7416 true-foot.gl.at.ply.gg tcp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp

Files

memory/876-1-0x00007FFF13FF3000-0x00007FFF13FF5000-memory.dmp

memory/876-0-0x00000000001D0000-0x00000000001E6000-memory.dmp

memory/876-2-0x00007FFF13FF0000-0x00007FFF14AB2000-memory.dmp

memory/876-3-0x00007FFF13FF0000-0x00007FFF14AB2000-memory.dmp

memory/876-8-0x00007FFF13FF0000-0x00007FFF14AB2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5757.tmp.bat

MD5 a50939825ffd91c5e6a55f989fccc5ea
SHA1 7cde65e3bec49fb4ae30f05d32546387320891d1
SHA256 bb81f36a61edb6f1a989f6129df4431ea70a590498a8dda7590c9f14224a2a8d
SHA512 6e0169f56f7fecb43ccceeb2b45c950b0701d4bd0cd43dca86b7eb189d6a880df2671f5ee08d90ff850de6b6b253ef3e9298a3bac002e290604bd805626957b4

C:\Users\Admin\AppData\Roaming\IDUX.exe

MD5 0ee060baaff3a8bca5b128a48c7fae05
SHA1 6469a7119a4a675a0ff228a76a59c9125a19f6a9
SHA256 a2295f8724805d78c537dd0750a0e777534013d5aad7472923e56e2b63135243
SHA512 cceef179d14892af12e8e53b6b8ed2569c6486a8b5447d17add393e1341bff698d1cc8a01f773e6f36369aaee7492ac8967242fa4fb0c2e9564102726db6caf0

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IDUX.exe.log

MD5 1569f2c982851def168a6a1dad27317a
SHA1 cca0d9a1aca7b213c527efec865e1caee36fa127
SHA256 fc9a4ce0e2bd7b632291798d9b436861bd9006b858ee148811201ebfe6458e26
SHA512 78c9101c78f685829db5314a10f45485813b2ede4561facaa5f965d94077772a2e445610631be15230df27aaeacee08ddd4cd02a9398a5e3877e5b6c16bbe2c1