Malware Analysis Report

2025-08-05 20:07

Sample ID 240611-qtj7laydmh
Target f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39
SHA256 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39

Threat Level: Shows suspicious behavior

The file f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Modifies system executable filetype association

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-11 13:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 13:33

Reported

2024-06-11 13:35

Platform

win7-20240221-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718112791" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718112791" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe

"C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp

Files

memory/2240-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 ee951622ddac01d99192b3d93d3f8a09
SHA1 01792dd9128e397514cbb7c53029e6c02294f22d
SHA256 c78267d510923bbba0405ba7e27bada7c20297b08bbf2d4741f5bac957d0dddd
SHA512 e02efeeee9d43432e94b234ee18c55656c7a5f37b53d5a591637793ac1964fe3f4a54d4bda35b4a3d88ff900f0c8d122298ba92b6b8bd13cf0f3a444267832eb

\Windows\system\rundll32.exe

MD5 c83dac1ebf567cfc52cf43cf006a1426
SHA1 2b0f3e6f4bf24eef5f69e948c9b50f4124b39087
SHA256 9f40bf3e3d4fc8a1ed963c75a3cafce791ef2b554e195d8c64445781c7341d90
SHA512 f2d748eca99c49a120746d7078e794b2de75c77c62158d5c71ba05595eddacb898a6d4b1d8d77c2f788aae605ae06a51004f21e6d1fc866435115e5dec748d2d

memory/2240-12-0x00000000002E0000-0x00000000002F6000-memory.dmp

memory/2472-20-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/2240-19-0x00000000002E0000-0x00000000002F6000-memory.dmp

memory/2240-21-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/2240-22-0x00000000002E0000-0x00000000002E2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 13:33

Reported

2024-06-11 13:35

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718112792" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718112792" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe

"C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

memory/5092-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 a7e9154c3d189f2a3166a35686ab943a
SHA1 0bd740a9cead8fd0882363e095238f1d4cab3320
SHA256 ab3ef812031f241c984c54602c8d64a3300c15e37b71f8cf3e6073566199316a
SHA512 2a4fa421197da9b762bf69c84070cfde3869b471e0b4bb55746a2815ac42a67c356b395de0110fba5157918a3567da630b9023420c087e9fa02b0836f8ea8b76

C:\Windows\System\rundll32.exe

MD5 13983c402307ef7511970c4f318c2223
SHA1 9faaff84b18dee46321d716de9074f5bde839b64
SHA256 1a30225edb8f7fa873c63b4d478f4ee8198ba8f670b2eb4d3bee7f68485d1d71
SHA512 a961f05d1a3f2d83c16d4bfd927aad710835e4efd5d2e48f305697b600e92ac30e802932a56c11058ad31cc5aa5635c0a1cf8611e47394842016f53c02ca6455

memory/5092-13-0x0000000000400000-0x0000000000415A00-memory.dmp