Malware Analysis Report

2025-08-10 12:16

Sample ID 240610-1sln5ssfrl
Target VirusShare_adbd221c643d94913045e5b4d633af10
SHA256 08df087a486ed6ae86ae2d2eafe476a400687668eeabad569bd14972dbad3e84
Tags
persistence upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

08df087a486ed6ae86ae2d2eafe476a400687668eeabad569bd14972dbad3e84

Threat Level: Shows suspicious behavior

The file VirusShare_adbd221c643d94913045e5b4d633af10 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence upx

UPX packed file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Modifies Internet Explorer Protected Mode Banner

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Modifies Internet Explorer Protected Mode

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-10 21:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 21:54

Reported

2024-06-10 21:57

Platform

win7-20240221-en

Max time kernel

149s

Max time network

139s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_adbd221c643d94913045e5b4d633af10.dll,#1

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\PROGRA~3\rundll32.exe N/A
N/A N/A C:\PROGRA~3\rundll32.exe N/A
N/A N/A C:\PROGRA~3\rundll32.exe N/A
N/A N/A C:\PROGRA~3\rundll32.exe N/A
N/A N/A C:\PROGRA~3\rundll32.exe N/A
N/A N/A C:\PROGRA~3\rundll32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\PROGRA~3\\rundll32.exe C:\\PROGRA~3\\jefobq.dat,FG00" C:\PROGRA~3\rundll32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~3\qbofej.bat C:\PROGRA~3\rundll32.exe N/A
File created C:\PROGRA~3\rundll32.exe C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\PROGRA~3\jefobq.dat C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\PROGRA~3\qbofej.pad C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\PROGRA~3\qbofej.pad C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\PROGRA~3\as98213.txt C:\PROGRA~3\rundll32.exe N/A
File opened for modification C:\PROGRA~3\qbofej.pad C:\PROGRA~3\rundll32.exe N/A
File created C:\PROGRA~3\qbofej.js C:\PROGRA~3\rundll32.exe N/A
File created C:\PROGRA~3\qbofej.reg C:\PROGRA~3\rundll32.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" C:\PROGRA~3\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\PROGRA~3\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\PROGRA~3\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\PROGRA~3\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\PROGRA~3\rundll32.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\PROGRA~3\rundll32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\PROGRA~3\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{163AAB41-2774-11EF-995F-5A791E92BC44} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424218369" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2292 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2292 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2292 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2292 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2292 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2292 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2292 wrote to memory of 2760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2760 wrote to memory of 2128 N/A C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2760 wrote to memory of 2128 N/A C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2760 wrote to memory of 2128 N/A C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2760 wrote to memory of 2128 N/A C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2760 wrote to memory of 2128 N/A C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2760 wrote to memory of 2128 N/A C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2760 wrote to memory of 2128 N/A C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2676 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2676 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2676 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2676 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2676 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2676 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2676 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2548 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2548 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2548 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2548 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2548 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2548 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2548 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2704 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2704 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2704 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2704 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2704 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2704 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2704 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2720 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2720 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2720 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2720 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2720 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2720 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2720 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2508 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2508 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2508 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2508 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2508 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2508 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2128 wrote to memory of 2508 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2704 wrote to memory of 2180 N/A C:\PROGRA~3\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2704 wrote to memory of 2180 N/A C:\PROGRA~3\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2704 wrote to memory of 2180 N/A C:\PROGRA~3\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2704 wrote to memory of 2180 N/A C:\PROGRA~3\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2180 wrote to memory of 2880 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2180 wrote to memory of 2880 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2180 wrote to memory of 2880 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2180 wrote to memory of 2880 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2180 wrote to memory of 2636 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\ctfmon.exe
PID 2180 wrote to memory of 2636 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\ctfmon.exe
PID 2180 wrote to memory of 2636 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\ctfmon.exe
PID 2704 wrote to memory of 2180 N/A C:\PROGRA~3\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2704 wrote to memory of 2180 N/A C:\PROGRA~3\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_adbd221c643d94913045e5b4d633af10.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_adbd221c643d94913045e5b4d633af10.dll,#1

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG00

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG01

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG02

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG03

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG04

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG06

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2

C:\Windows\system32\ctfmon.exe

ctfmon.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.bing.com udp
AT 66.197.215.165:443 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
RU 37.139.53.102:443 tcp
US 8.8.8.8:53 whatwillber.com udp

Files

memory/2760-2-0x0000000000180000-0x00000000001AB000-memory.dmp

memory/2760-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

\PROGRA~3\jefobq.dat

MD5 adbd221c643d94913045e5b4d633af10
SHA1 92439678c776ef831f0e33af4e7f2d04b5f3902c
SHA256 08df087a486ed6ae86ae2d2eafe476a400687668eeabad569bd14972dbad3e84
SHA512 0183343909d25c4274245cd1c358a8909a5afc97f5a1d23d34ed798812d57fcfeeac5940dea21f9fb08663f39b5cdf64fed663ec835cbb35fbbe7f635ad18882

memory/2760-6-0x0000000000180000-0x00000000001AE000-memory.dmp

\PROGRA~3\rundll32.exe

MD5 51138beea3e2c21ec44d0932c71762a8
SHA1 8939cf35447b22dd2c6e6f443446acc1bf986d58
SHA256 5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512 794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

memory/2128-17-0x0000000000210000-0x000000000023B000-memory.dmp

memory/2128-16-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2760-41-0x0000000000370000-0x000000000039E000-memory.dmp

memory/2128-42-0x0000000000210000-0x000000000023E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab5CC1.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar5DD3.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f2433d5ba95f00fb60a20088de72ebfc
SHA1 3f8e865d38eabcde46936f20083e3107362a9e09
SHA256 9794e76f40fd1b2e0fb7ce8484d88e6460f7ff1ead24b738f194343939af3180
SHA512 3fa9dd14de6ed0f0f168ffef75b3b6e53d747a012551d199a5b1239ff975f67812d3b331bfd5d40314b07dd9cfffe2ac76e6085f445c2d70f6de88d6803386a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 97bb751c2dd003809c40de956f852fb6
SHA1 c959f094fbdf82b6c54151ff4314a0e96d27a244
SHA256 28bc258acafab51c2bda43c68dfa7b209d1c0b884031598a368c301ad4d9650b
SHA512 1d852934c41272bfae0bac26cc3ff4da7bdcce34acb39583d737f9ef4fa6859d6bb180d94f1bd90578a0ed5654bc38c970822dd0096a67f4608d5aa7b06c46e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7708f464790db0783821a73b0225fce
SHA1 51d6e2a1dbb8b12f2bfaa0540bbbc69c158de208
SHA256 7ad1cae0b258d4e5bb219248f299dd54341664163f869b0b959eaeaf01251b68
SHA512 ae8115ba260d46c775480579867d835da1c06779a5ac7264fb03e5ea37235e1d93af35031d2fec53b135863ae8ef9a8b087d20f8bf528ee0268cf09a27ad12b1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9270b71c72a0668b88b945a7b131a1b8
SHA1 70f0c2c7bb4ac1841d73832de99981a758613040
SHA256 681fcc27a77516b88c6226df2c9f04cdd2213e0139ae9ea8b8ed62b13cf96629
SHA512 47f5aeb57bb95eaaf02d45e162a34c2456e1ed4331d03e76a52887fef1dc4fb921c1cc94c3122c046274c1e72ecbafe99d7bfd82359a59436563223cee9eacc2

memory/2508-218-0x0000000000210000-0x000000000023E000-memory.dmp

memory/2720-217-0x0000000000200000-0x000000000022E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 baadbdc3ccbd49e4f7729c525ff77d91
SHA1 31431bcda882da14f065558378e290252be6bdea
SHA256 95754a1758a8be69c5e105bc93fb05dcf9d8eb3737e1cce2459512975d0cc7de
SHA512 1fc71565dc8f52a496b88b77069b02f229c603ff0465ab68309882796343508649c55a00cce4337d56a5d531c8fd21bcba88b44729a92ae797840f7fc3af3151

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c9492ade78d20b181feef176a6a57744
SHA1 45892163aa9cfe3a66645c81a0b56030c76b5cca
SHA256 fe11b0039c868c3bb5da6ef02a5c3d4cda05ff0e14b159a44d9e92a40118740f
SHA512 73a0b7b8b0e1cb4d686215bda5c324c2173e8c5ecf34413898d91209e203814a2129ea14cd9d5853ec06122617921021b0b27ea7471042d9ef0a8273ac9476e5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cef708b6d68c900a4c8cc1983f16eed0
SHA1 86a06609b7222cea36cf2a76e069b37b47ed9cec
SHA256 c0a7bb26be1fb14db505bbb9be4e08d1719b842c9625fbbd291c815fe84b4552
SHA512 e8b7b9bb1b4645d2a0138e6c7e8ebb0ce193df26d37e034fe6471bb786bb2a6a9b953af5d4581580671fa8af673924f7bcd244e68a738094f5287df794cffa65

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 42a113011ccbd6f2f16e6bc1f727485e
SHA1 5c9bc8d517a0742165d1862f4aec9323afa62dd5
SHA256 ed3970f35e5d59e506708b3e4770de9030ca43694740998829c575a3ee54d106
SHA512 af782b544fa33fba8614530fb00f0ee7c7e16b4a50f3b034e170171fa3ad3c7886f528e19350bb7cb9ef8bbc9ddf6c92b1d871645e9c5c3d1ab1b743c66728f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6dd7dcef5dcc1add4f560ab88b815056
SHA1 92d9e047704947223f7f53712b9014a631c20eba
SHA256 d98f3046426a5354bffac3a3fa720e1ca1e8b0fbebfcade9e03e6a3961608d55
SHA512 f1d1028ad6f8894b5d2b232f13875f2c6c1889df99da549eceb9935e34f6657d849ca288de5c13e11dbb9bd59d135c2574757b7522cedc9b83ec5593f1092cf9

memory/2760-524-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2760-525-0x0000000000180000-0x00000000001AB000-memory.dmp

memory/2128-530-0x0000000000210000-0x000000000023B000-memory.dmp

memory/2128-529-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2720-536-0x0000000000200000-0x000000000022E000-memory.dmp

memory/2508-547-0x0000000000210000-0x000000000023E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84c2f3887f8f6cceb31af93942f90072
SHA1 a34b7fc8bdf84fb6a3bc1b8112bb97b8706d4340
SHA256 216465db0020f876d7cd1ab34b667d4f031ea1b7de47fa3df55ad7b3e6674be7
SHA512 5834a22b59fd01daaec99e4be385776a68827086ea69fab4dff1d336a212b4f3823eaa728f6f1125a208022d9a8692dfa3c440280d9088d8f962827d4e18dcdb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6392379d405314a811fe41b18ef0d241
SHA1 a1b28499051331964cc554c77c7903b8b5aa4f2a
SHA256 3dc361a80a8ceeb3930c3939ccb2c101a279a632c33fc22787099a0249efdff7
SHA512 81a7dee67187bb7b9d86fbba938608371179a70d81815d774ca37f1d32300e6a864ab62f96dd4b3c3b84bfcdc217e71c7ba2f1e58a947d4c61692f2b88de9807

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f7392f3373aed97f0ec8c3a21c2b657
SHA1 fef1386984fc2549b7bfec8f89bd64e0f30deae9
SHA256 323279bc5141df31d0ed73a00bb9963fc911cd486f37a41584c4b246535daa73
SHA512 3b29dc0918b66db7532de191a65eb4e496b4a0333501ccaee8dee8c5d3649f492609730fc15abc2e641bb9cf45ad67581ea768c93e632a07a9429b8a080f582d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0c009258244f92f29743636970e6de34
SHA1 4af45d64dbe716a27f9795e8b23beac27cd0c630
SHA256 44448e1e7a7e917449030dbc74f8329a4185b9a33cd7c1052f2e1a0430686a31
SHA512 0efdce2eaa1c18dbc46349ab021b0c7163cf174ed314242bc7006966ff510d5dda5ec31caf6d86500a0a27894519acc8c415b6af34c7e4d74e19d62511d1bac6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 342e99230b6169818222a85024fc1bc5
SHA1 b83eabb81e6b4ab6085ae72cc68811ea4999726d
SHA256 a5cf37951b5edc5582496e133a915bc86152ee98b8615df0955625e3a936d9fa
SHA512 45c1a75e72975cb4082fc9e0554588391522447627664c630def0b4344eb51dea077ff2c5348e474fd99f20c383926ac7700ab81747e6dd63b891081bc6ceaef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4580772d1b3c9739747a5e7ea918b870
SHA1 107e11b42afa085fb03d59d433e749a851615890
SHA256 4dc6d252c90d3a619c9f20fceef4dbf0ae3094603bd34d4187c8121df94a6dea
SHA512 ef7fd6389c939bd97e6c2f4010bb3c21083acffab2b72d4fb6476f846c78198738c1399a01e079840f5abc43b543484cbdb8e8ffce5628aac5d0f1e0aa9a2793

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 508cd1e866e059a3a1b38061503e07fa
SHA1 5192de1ae8f2d440ee4a568b671b1149f93ba7bd
SHA256 3ac4723f4c46e4258f2045afcfa8f6ccbcfedea25fc2ab9f4b02afc222f407bd
SHA512 b9a01da0695afc1293cc5534b9cdb415af549d8be808e41f936d9d2a075d6c23ba87e32bc30a3d23e6832ab15af5c9fd3033202fde1852281176190ea99fc13c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3824d50dea21e8d41198396ffb2e782a
SHA1 608ae9dfcb6693d945f4721bee46b36460c2b1be
SHA256 e84a22b07169e555eafccdc5e5c005d5ed377a1edfba9e87d92cb535afce17e1
SHA512 ad79926f7f95624af6e784fe67db9321ac26bd04518027d55704a264c212525ab8e6ae48e2fedacc0a7d9a022cc8743ce3b58c13d7a2fbd2a4a6c8a9a643deeb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 34986808a3f730e01aa8482e4150fa29
SHA1 cfa08f2ad62ca787267e58857c79da89f2bf64d8
SHA256 48e772b493f4e80cf4877f4a83fde0443044d6632fba4980b8f3f8a0e49d468d
SHA512 428a507859f26bee5e5833a3e5460b2d438d749a87f2da4e3cf67ad72a8291152a69f10f590b7ab10b6d239d94a1a345234a5eb89a6b1e70b1b4b03abe25803d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c8f2bd6d5533671eb11c16fe7f11cc5
SHA1 3ad0f7c1a03d7eb5d2d810d24f509a40076a7e89
SHA256 6f62a12db8e4f319c1794873c16f2a97e146a0cf9594f0c309233b96c2a97066
SHA512 9841c3d52bf81bd221cf196f7c65871bc7fc9977b3b912a91ece61f5d2234468d42815abeed39255e00b11f3963929c99588c2c0c8b2177412d9a6a93cbd7617

memory/2508-1037-0x0000000000210000-0x000000000023E000-memory.dmp

memory/2508-1047-0x0000000000210000-0x000000000023E000-memory.dmp

memory/2508-1052-0x0000000000210000-0x000000000023E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 21:54

Reported

2024-06-10 21:57

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_adbd221c643d94913045e5b4d633af10.dll,#1

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\PROGRA~3\rundll32.exe N/A
N/A N/A C:\PROGRA~3\rundll32.exe N/A
N/A N/A C:\PROGRA~3\rundll32.exe N/A
N/A N/A C:\PROGRA~3\rundll32.exe N/A
N/A N/A C:\PROGRA~3\rundll32.exe N/A
N/A N/A C:\PROGRA~3\rundll32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\PROGRA~3\\rundll32.exe C:\\PROGRA~3\\brigi.dat,FG00" C:\PROGRA~3\rundll32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~3\igirb.pad C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\PROGRA~3\igirb.pad C:\PROGRA~3\rundll32.exe N/A
File created C:\PROGRA~3\igirb.js C:\PROGRA~3\rundll32.exe N/A
File created C:\PROGRA~3\igirb.bat C:\PROGRA~3\rundll32.exe N/A
File created C:\PROGRA~3\igirb.reg C:\PROGRA~3\rundll32.exe N/A
File created C:\PROGRA~3\rundll32.exe C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\PROGRA~3\brigi.dat C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\PROGRA~3\igirb.pad C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\PROGRA~3\as98213.txt C:\PROGRA~3\rundll32.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\PROGRA~3\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\PROGRA~3\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\PROGRA~3\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" C:\PROGRA~3\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\PROGRA~3\rundll32.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\PROGRA~3\rundll32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main C:\PROGRA~3\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1CD6C7B7-2774-11EF-BCA5-CEC6030110C3} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424218391" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1924 wrote to memory of 4656 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1924 wrote to memory of 4656 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1924 wrote to memory of 4656 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4656 wrote to memory of 1408 N/A C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 4656 wrote to memory of 1408 N/A C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 4656 wrote to memory of 1408 N/A C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 556 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 556 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 556 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 3816 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 3816 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 3816 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 2636 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 2636 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 2636 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 4804 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 4804 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 4804 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 3772 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 3772 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 1408 wrote to memory of 3772 N/A C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe
PID 2636 wrote to memory of 548 N/A C:\PROGRA~3\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2636 wrote to memory of 548 N/A C:\PROGRA~3\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 548 wrote to memory of 4604 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 548 wrote to memory of 4604 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 548 wrote to memory of 4604 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2636 wrote to memory of 548 N/A C:\PROGRA~3\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2636 wrote to memory of 548 N/A C:\PROGRA~3\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_adbd221c643d94913045e5b4d633af10.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_adbd221c643d94913045e5b4d633af10.dll,#1

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG00

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG01

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG02

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG03

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG04

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG06

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:548 CREDAT:17410 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 api.bing.com udp
AT 66.197.215.165:443 tcp
RU 37.139.53.102:80 tcp
US 8.8.8.8:53 whatwillber.com udp

Files

memory/4656-0-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

memory/4656-1-0x00000000014A0000-0x00000000014CB000-memory.dmp

C:\ProgramData\brigi.dat

MD5 adbd221c643d94913045e5b4d633af10
SHA1 92439678c776ef831f0e33af4e7f2d04b5f3902c
SHA256 08df087a486ed6ae86ae2d2eafe476a400687668eeabad569bd14972dbad3e84
SHA512 0183343909d25c4274245cd1c358a8909a5afc97f5a1d23d34ed798812d57fcfeeac5940dea21f9fb08663f39b5cdf64fed663ec835cbb35fbbe7f635ad18882

memory/4656-9-0x00000000014A0000-0x00000000014CE000-memory.dmp

C:\ProgramData\rundll32.exe

MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

memory/1408-19-0x0000000000560000-0x000000000058B000-memory.dmp

memory/1408-18-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/4656-41-0x0000000003300000-0x000000000332E000-memory.dmp

memory/1408-42-0x0000000000560000-0x000000000058E000-memory.dmp

memory/556-43-0x0000000002670000-0x000000000269E000-memory.dmp

memory/2636-45-0x0000000000F10000-0x0000000000F3E000-memory.dmp

memory/3816-44-0x0000000000600000-0x000000000062E000-memory.dmp

memory/4804-46-0x0000000000FF0000-0x000000000101E000-memory.dmp

memory/3772-47-0x0000000000FE0000-0x000000000100E000-memory.dmp

memory/4656-53-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

memory/4656-54-0x00000000014A0000-0x00000000014CB000-memory.dmp

memory/4804-55-0x0000000000FF0000-0x000000000101E000-memory.dmp

memory/3772-56-0x0000000000FE0000-0x000000000100E000-memory.dmp

memory/1408-61-0x0000000000560000-0x000000000058B000-memory.dmp

memory/1408-60-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/4804-72-0x0000000000FF0000-0x000000000101E000-memory.dmp

memory/3772-85-0x0000000000FE0000-0x000000000100E000-memory.dmp

memory/3772-93-0x0000000000FE0000-0x000000000100E000-memory.dmp

memory/3772-105-0x0000000000FE0000-0x000000000100E000-memory.dmp