Malware Analysis Report

2025-01-06 08:58

Sample ID 240604-a15h4sfb2v
Target 9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef
SHA256 9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef
Tags
evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef

Threat Level: Known bad

The file 9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan

Windows security bypass

Modifies Installed Components in the registry

Sets file execution options in registry

Windows security modification

Executes dropped EXE

Loads dropped DLL

Modifies WinLogon

Drops file in System32 directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-04 00:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 00:41

Reported

2024-06-04 00:44

Platform

win7-20240221-en

Max time kernel

149s

Max time network

118s

Command Line

winlogon.exe

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450} C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\IsInstalled = "1" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\StubPath = "C:\\Windows\\system32\\ubboofoor.exe" C:\Windows\SysWOW64\idxeavet.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\xketoac-ofom.exe" C:\Windows\SysWOW64\idxeavet.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" C:\Windows\SysWOW64\idxeavet.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} C:\Windows\SysWOW64\idxeavet.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\aglapoot-coot.dll" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" C:\Windows\SysWOW64\idxeavet.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\aglapoot-coot.dll C:\Windows\SysWOW64\idxeavet.exe N/A
File opened for modification C:\Windows\SysWOW64\idxeavet.exe C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe N/A
File created C:\Windows\SysWOW64\idxeavet.exe C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe N/A
File opened for modification C:\Windows\SysWOW64\xketoac-ofom.exe C:\Windows\SysWOW64\idxeavet.exe N/A
File opened for modification C:\Windows\SysWOW64\ubboofoor.exe C:\Windows\SysWOW64\idxeavet.exe N/A
File created C:\Windows\SysWOW64\xketoac-ofom.exe C:\Windows\SysWOW64\idxeavet.exe N/A
File created C:\Windows\SysWOW64\ubboofoor.exe C:\Windows\SysWOW64\idxeavet.exe N/A
File created C:\Windows\SysWOW64\aglapoot-coot.dll C:\Windows\SysWOW64\idxeavet.exe N/A
File opened for modification C:\Windows\SysWOW64\idxeavet.exe C:\Windows\SysWOW64\idxeavet.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\idxeavet.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe C:\Windows\SysWOW64\idxeavet.exe
PID 2340 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe C:\Windows\SysWOW64\idxeavet.exe
PID 2340 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe C:\Windows\SysWOW64\idxeavet.exe
PID 2340 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe C:\Windows\SysWOW64\idxeavet.exe
PID 1948 wrote to memory of 436 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\system32\winlogon.exe
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1284 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\SysWOW64\idxeavet.exe
PID 1948 wrote to memory of 1284 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\SysWOW64\idxeavet.exe
PID 1948 wrote to memory of 1284 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\SysWOW64\idxeavet.exe
PID 1948 wrote to memory of 1284 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\SysWOW64\idxeavet.exe
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1196 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe

"C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe"

C:\Windows\SysWOW64\idxeavet.exe

"C:\Windows\SysWOW64\idxeavet.exe"

C:\Windows\SysWOW64\idxeavet.exe

--k33p

Network

Country Destination Domain Proto
US 8.8.8.8:53 zccdo.nu udp
US 8.8.8.8:53 zccdo.nu udp

Files

\Windows\SysWOW64\idxeavet.exe

MD5 8d5669edc96e52e9bc0e26f2e4f4c198
SHA1 16d2446f83e1eb34e7596e5d6eb5b17a7a04d0e0
SHA256 86bfe6a4b91197ffeaf29a8c2fa97bb2d9beaf4e23d579e26bd9d76493872843
SHA512 fedd92b3d20092b9960a8b34dc6d8376018ff273479dfba47d64fba719df8aa34d83b5829c7d4a8d141ac4d3d94e6bc8fa71c9338fc75814c37cab9462b8b1d6

memory/2340-7-0x0000000000400000-0x0000000000403000-memory.dmp

C:\Windows\SysWOW64\aglapoot-coot.dll

MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

C:\Windows\SysWOW64\xketoac-ofom.exe

MD5 7fe6b4a595247e3f179a76600ffea5d5
SHA1 92f44c03772f6103ab38a6bf480c9a756564e503
SHA256 15c26633018bc2a254baac20c38188a90a7ec3f9cf6d0ab7f3af7b588809739e
SHA512 b619dd13a25c847f861682a2a9760abbd6c6d0343dacac59639997405be903e3a132c18b53e118c5b09d244ee9cfb89ce0a25bb9cce8d20b4f5ee38941af7f98

C:\Windows\SysWOW64\ubboofoor.exe

MD5 2b45039a8c5cfe83622eb7d0a4bc2c5e
SHA1 eaf158691f2f550e0cdb6bc838b9a665b9f39c07
SHA256 dcca2a169604e543715595b1d11a0d1318c1cdf99e6903d55737e0d7267fc27e
SHA512 dc85e422f0a08f5302846c1ff0b93dd353ac43a722ae208e7b6654b26815dcef853fd108ffe4d9f2204308ed6d7b8ebad4362771884fa61a2449d5c89fabfb48

memory/1948-53-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1284-54-0x0000000000400000-0x0000000000414000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-04 00:41

Reported

2024-06-04 00:44

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

93s

Command Line

winlogon.exe

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743} C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743}\IsInstalled = "1" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743}\StubPath = "C:\\Windows\\system32\\ubboofoor.exe" C:\Windows\SysWOW64\idxeavet.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\xketoac-ofom.exe" C:\Windows\SysWOW64\idxeavet.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\idxeavet.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" C:\Windows\SysWOW64\idxeavet.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} C:\Windows\SysWOW64\idxeavet.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" C:\Windows\SysWOW64\idxeavet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\aglapoot-coot.dll" C:\Windows\SysWOW64\idxeavet.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\aglapoot-coot.dll C:\Windows\SysWOW64\idxeavet.exe N/A
File opened for modification C:\Windows\SysWOW64\ubboofoor.exe C:\Windows\SysWOW64\idxeavet.exe N/A
File created C:\Windows\SysWOW64\idxeavet.exe C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe N/A
File opened for modification C:\Windows\SysWOW64\xketoac-ofom.exe C:\Windows\SysWOW64\idxeavet.exe N/A
File created C:\Windows\SysWOW64\xketoac-ofom.exe C:\Windows\SysWOW64\idxeavet.exe N/A
File created C:\Windows\SysWOW64\ubboofoor.exe C:\Windows\SysWOW64\idxeavet.exe N/A
File opened for modification C:\Windows\SysWOW64\aglapoot-coot.dll C:\Windows\SysWOW64\idxeavet.exe N/A
File opened for modification C:\Windows\SysWOW64\idxeavet.exe C:\Windows\SysWOW64\idxeavet.exe N/A
File opened for modification C:\Windows\SysWOW64\idxeavet.exe C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A
N/A N/A C:\Windows\SysWOW64\idxeavet.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\idxeavet.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4984 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe C:\Windows\SysWOW64\idxeavet.exe
PID 4984 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe C:\Windows\SysWOW64\idxeavet.exe
PID 4984 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe C:\Windows\SysWOW64\idxeavet.exe
PID 3580 wrote to memory of 3404 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\SysWOW64\idxeavet.exe
PID 3580 wrote to memory of 3404 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\SysWOW64\idxeavet.exe
PID 3580 wrote to memory of 3404 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\SysWOW64\idxeavet.exe
PID 3580 wrote to memory of 636 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\system32\winlogon.exe
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE
PID 3580 wrote to memory of 3368 N/A C:\Windows\SysWOW64\idxeavet.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe

"C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe"

C:\Windows\SysWOW64\idxeavet.exe

"C:\Windows\SysWOW64\idxeavet.exe"

C:\Windows\SysWOW64\idxeavet.exe

--k33p

Network

Country Destination Domain Proto
US 8.8.8.8:53 uwzsaewxaoidq.tk udp
US 8.8.8.8:53 uwzsaewxaoidq.tk udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

C:\Windows\SysWOW64\idxeavet.exe

MD5 8d5669edc96e52e9bc0e26f2e4f4c198
SHA1 16d2446f83e1eb34e7596e5d6eb5b17a7a04d0e0
SHA256 86bfe6a4b91197ffeaf29a8c2fa97bb2d9beaf4e23d579e26bd9d76493872843
SHA512 fedd92b3d20092b9960a8b34dc6d8376018ff273479dfba47d64fba719df8aa34d83b5829c7d4a8d141ac4d3d94e6bc8fa71c9338fc75814c37cab9462b8b1d6

memory/4984-3-0x0000000000400000-0x0000000000403000-memory.dmp

C:\Windows\SysWOW64\ubboofoor.exe

MD5 fedce9c2949b0bbeeb0a22fd757a596a
SHA1 cbe013a1440309da8ab3379135f9dfadeca979b1
SHA256 6d8e80600518209596e038c05d3af06dea7e4e79b50cbc4700a553d7cd9c0b67
SHA512 6c706254cde33c07d07a9c5e3c2bd210c7ed80d1339ebd8fa31ec730206a6016278c9ea9ec062ea60b21412665ed9f392d480005914c64653c604bc4d3f46bbf

C:\Windows\SysWOW64\xketoac-ofom.exe

MD5 0ddc9e32eeb64bc3c2b63d5325f7cf0d
SHA1 0c21f7c052b51946ed35b4d2bd993f4ff05b77ec
SHA256 0995d459eb82e621b83003d02fbbb0b8cd9263184ecb4d261c2e009ef95e6011
SHA512 b8c3188540b9d70c1de9aa16ef4ffbcffe48a0c3c8f2bc6ed64e3b31c7e89c25cc3f2bd38e680368ed44ec0a5b9405c2c28bce32dac93191d52d8ab00c049dd0

C:\Windows\SysWOW64\aglapoot-coot.dll

MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

memory/3580-47-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3404-48-0x0000000000400000-0x0000000000414000-memory.dmp