Malware Analysis Report

2025-04-13 20:42

Sample ID 240704-bl1r2swerk
Target 1d894ccf1bf9cc7cda7635381d7a94e8.bin
SHA256 11330085f972e84aa69dde2e79fe61f204987d401a72066cc63bab5fd9739dd5
Tags
aspackv2 modiloader trojan persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

11330085f972e84aa69dde2e79fe61f204987d401a72066cc63bab5fd9739dd5

Threat Level: Known bad

The file 1d894ccf1bf9cc7cda7635381d7a94e8.bin was found to be: Known bad.

Malicious Activity Summary

aspackv2 modiloader trojan persistence

ModiLoader, DBatLoader

ModiLoader First Stage

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

ASPack v2.12-2.42

Deletes itself

Adds Run key to start application

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Program crash

NTFS ADS

Modifies registry class

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: LoadsDriver

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-04 01:14

Signatures

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20240221-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Ƴ$'°± C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\›#'x™ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Öl!'Àn C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ÞD!'¸F C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\–B!' C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\img\imglist.bmp C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Pãô˜ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ž&'ø C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\žð9'øò C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Î>'¨ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¦Ú;'Ù C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¾:'“ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\®=' C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\N ='( C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Ћãô˜ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Ÿ&'€ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\î* 'È( C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\þŸ"'؝ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\FW?'0U C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\>ƒ>'˜ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\æv='Ðt C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\FÀ;'0Â C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\î¾('ȼ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\öÄ''àÆ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\n¨''Hª C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\‘''h“ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Ù!'hÛ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\f='P C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\&!'h$ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\>¤ '˜¦ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\V5>'@7 C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ŽÅ;'èÇ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¦h:'k C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ˆæ]w C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\î•&'È— C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Æ&'° C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\FV:'0T C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\vÔ9'`Ö C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¦ü"'ÿ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\f…>'P‡ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\F{<'0y C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Ö´;'À¶ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\®²;'± C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\F ;'0 C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\F '0  C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\öy>'à{ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\6Ï;' Í C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\vù;'`û C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\–Ó:' C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¶ã&' â C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\&X#'Z C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\æR 'ÐP C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\†ª&'ð¨ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¶+!' * C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\FŸ9'0 C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\\;'€- C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\öê:'àè C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¦J''I C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¼%'x¾ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Ö'"'À% C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¦Ø%'Û C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\î¹#'È» C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\fÓ"'PÑ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\6%'  C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\&Ä:'Æ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\.œ:'ˆž C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\†ƒ:'ð C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\6]:' _ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\N.:'(, C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Ná:'(ã C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\fö:'Pô C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\>ì:'˜î C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\·:'hµ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\v:'` C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Öý:'Àÿ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\®û:'ú C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¾:'“ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Ž[:'èY C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\L:'xN C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ö3:'à1 C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\n:'H C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\†8%'ð: C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\®@:'C C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Þ":'¸ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\æš:'И C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\nÎ:'HÌ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ž«:'ø© C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\V¦:'@¤ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\îr:'Èp C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\~g:'Xe C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\n8<'H: C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\–Ó:' C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¶¸:' » C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ÖJ:'ÀH C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ÞÕ:'¸× C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\t:'€v C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¦h:'k C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\FV:'0T C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\f?:'P= C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\–:' C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\& :' C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\þ :'Ø C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ß:'pÝ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\þÂ:'ØÀ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Æ­:'°¯ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Î…:'¨‡ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\^~:'8| C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\>5:'˜7 C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\$:'p& C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¶:'  C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\öê:'àè C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe"

Network

N/A

Files

\Program Files (x86)\baidu\bar\BDBar_tmp\BaiduBar.dll

MD5 0c8ed82bce60e5e2860d9daa28289267
SHA1 5ea9dcfadc426463c51e0abfc736a42dfc31f3e9
SHA256 89bc3949eb1ab805b49f2699f0623796997ba7bf0f5acf9402f90ae5cd630d13
SHA512 2a6b90d1ee12d88a9866b774de5b52b329beebbb9ce0c1655455020aeaddd0824cd3c38804e76f777b81fa5b149744b392ea8f904ba2eb71c6db779a0ef85830

memory/1460-14-0x0000000000930000-0x00000000009CC000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20240611-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe"

Signatures

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\band_s.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A
File created C:\Windows\SysWOW64\band_s.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CABF6E-22D8-4733-A08F-9C35A1A3679C} C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CABF6E-22D8-4733-A08F-9C35A1A3679C}\send = "1" C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CABF6E-22D8-4733-A08F-9C35A1A3679C}\loop = "1" C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CABF6E-22D8-4733-A08F-9C35A1A3679C}\name = "8200" C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 -s C:\Windows\system32\band_s.dll

Network

N/A

Files

C:\Windows\SysWOW64\band_s.dll

MD5 140ca271c5d12f031ab2f3cbc98ee19d
SHA1 034af3cf6762c155b5a104c242b68d7c5a7dd76f
SHA256 b5187fb26ae50a447d935bcd618a721dc95e0d5d2eb74a38525a8bae6aa39e35
SHA512 cf87048cd15117412c6bc0ced68923abd85cb940ffddc75a66651337340d41f98a1e8a0e19f5394031d4d4da4109399ab56a92da0205236ceeb3d1065ba1009b

memory/2252-3-0x0000000000400000-0x0000000000444000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:18

Platform

win7-20231129-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\aabhor.sys C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File created C:\Windows\SysWOW64\drivers\lasajhr.sys C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\Anfad.sys C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\fad.sys C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\hProcess.sys C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ypm687.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\y724\y724.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\ntabhor.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File opened for modification C:\Windows\SysWOW64\ntsvrs.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File opened for modification C:\Windows\SysWOW64\ServeHost.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D157330A-9EF3-49F8-9A67-4141AC41ADD4}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{ABEC6103-F6AC-43A3-834F-FB03FBA339A2} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BB936323-19FA-4521-BA29-ECA6A121BC78}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6231D512-E4A4-4DF2-BE62-5B8F0EE348EF} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1B0E7716-898E-48CC-9690-4E338E8DE1D3}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BB936323-19FA-4521-BA29-ECA6A121BC78} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D157330A-9EF3-49F8-9A67-4141AC41ADD4} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1B0E7716-898E-48CC-9690-4E338E8DE1D3} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B83FC273-3522-4CC6-92EC-75CC86678DA4}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6231D512-E4A4-4DF2-BE62-5B8F0EE348EF}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B83FC273-3522-4CC6-92EC-75CC86678DA4} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{ABEC6103-F6AC-43A3-834F-FB03FBA339A2}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2328 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2328 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2328 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2328 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2328 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2328 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2328 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2328 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Users\Admin\AppData\Local\Temp\ypm687.tmp
PID 2328 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Users\Admin\AppData\Local\Temp\ypm687.tmp
PID 2328 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Users\Admin\AppData\Local\Temp\ypm687.tmp
PID 2328 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Users\Admin\AppData\Local\Temp\ypm687.tmp
PID 2328 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Users\Admin\AppData\Local\Temp\ypm687.tmp
PID 2328 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Users\Admin\AppData\Local\Temp\ypm687.tmp
PID 2328 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe C:\Users\Admin\AppData\Local\Temp\ypm687.tmp
PID 2904 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ypm687.tmp C:\Users\Admin\AppData\Local\Temp\y724\y724.exe
PID 2904 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ypm687.tmp C:\Users\Admin\AppData\Local\Temp\y724\y724.exe
PID 2904 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ypm687.tmp C:\Users\Admin\AppData\Local\Temp\y724\y724.exe
PID 2904 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ypm687.tmp C:\Users\Admin\AppData\Local\Temp\y724\y724.exe
PID 2904 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ypm687.tmp C:\Users\Admin\AppData\Local\Temp\y724\y724.exe
PID 2904 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ypm687.tmp C:\Users\Admin\AppData\Local\Temp\y724\y724.exe
PID 2904 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ypm687.tmp C:\Users\Admin\AppData\Local\Temp\y724\y724.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /u /s "C:\Program Files (x86)\SearchNet\SNHpr.dll"

C:\Users\Admin\AppData\Local\Temp\ypm687.tmp

C:\Users\Admin\AppData\Local\Temp\ypm687.tmp

C:\Users\Admin\AppData\Local\Temp\y724\y724.exe

"C:\Users\Admin\AppData\Local\Temp\y724\y724.exe" 00000402

Network

N/A

Files

memory/2328-0-0x0000000000400000-0x000000000048E000-memory.dmp

\Users\Admin\AppData\Local\Temp\ypm5FA.tmp

MD5 bf503cb6fe413cb3ba2ebda4ca0d96f8
SHA1 40f3e827c2ef381e894cb1e592ef08f0ce0277e5
SHA256 fafd103b6fab2b2b243284bdcfcccb2bea87f66fac4cfbc072eef84d72bf4eaf
SHA512 bc0ec882d90acbb215fb4d89a7c138a79f6cc46736fc56f870297069b15f3bfda0b6fdf162c67a4fe8211c8419e520c2e25c91cbe22bec307690c042c2a85788

memory/2328-5-0x0000000010000000-0x0000000010019000-memory.dmp

memory/2328-13-0x0000000010000000-0x0000000010019000-memory.dmp

\Users\Admin\AppData\Local\Temp\ypm687.tmp

MD5 34287b9bad575dfe21ce5364755b63af
SHA1 15503e83525a14ac31058eb01850f6177a72a706
SHA256 27edccdf0def484aa1727d1c6883a9fa1b243b4d55e784b221ae39f68eb6b95f
SHA512 5f7595616fb9188c9f0032c215d1d822de6396895e0f8a3a0f8de491a91974f93b6244149d36331e79226891ec512c1287f9039c606000da2df44980244478eb

memory/2328-27-0x0000000000400000-0x000000000048E000-memory.dmp

\Users\Admin\AppData\Local\Temp\y724\y724.exe

MD5 b9d4e392e8ac6a4420f126cc88d8c0c1
SHA1 3fa9755060979a13973927906222a4929bb4c80f
SHA256 3d20d973651546be8d370ff9013bbdc03282808a212731b92852f0b789634064
SHA512 03fe62e90efaa0cf064c335d7dd4df912f738a85726eb77269687f398511b883400eb0b95d3a8158d2a5b7fec37e073bbde754a5b53e17732b18f667d9960128

C:\Users\Admin\AppData\Local\Temp\y724\cdnprh.dll

MD5 9076a436c1a5cfdc687714982a6cb86f
SHA1 66357580e2264f23648714254941b7a61d214237
SHA256 000d138eec71e8c16d40a9930c3f0939f7608175f68588d34c07f3a74e71dbde
SHA512 4956ddaabb0fa9a783012102d069c3ee05fa64f25bc9c02b4ff86f15e26b0abb5ce9aa5cdfc3a4844a68123eac64784d4b20c774de0d36aa0b71e35e97c3b834

C:\Users\Admin\AppData\Local\Temp\y724\cdnins.dll

MD5 1f2d2dbf570ecc45a9e2ce45f264199f
SHA1 bf0656f98e26754f48eb5908319067641ae51d8d
SHA256 766ebfa9689728c545a45cc82cce611a9343bc544fc712dc31881d0f2854296c
SHA512 96e41545336d21bf289d203a56e3bf27ed4d3abcbd23332a590f38adc6568a81f3d10f129539e4efdd751be4e02a7d95052b455c04b6ba0a11c8d4c21a2411a0

C:\Users\Admin\AppData\Local\Temp\y724\src.dat

MD5 3ab47841cbacd4f95fcc14e5adb758be
SHA1 1e8c5f3d741f94f5c85afe4af77d9ce2ddf9e19c
SHA256 c7c926fd1865f3c2dccb3ec9bd8aac72da8c80036df874e38fb2644159d6f381
SHA512 51e633fcf74383e72a11b266e500c440062a9760850c3e6ac80ab1ae8673cc9428b913cd3c8961a46fb854d561b2eccfb30077b9c3f68706b87924b6db38e997

Analysis: behavioral16

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\fad.sys C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\hProcess.sys C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\aabhor.sys C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File created C:\Windows\SysWOW64\drivers\hafiq.sys C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\Anfad.sys C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\rnq4894.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\48D2\48D2.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\ntsvrs.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File opened for modification C:\Windows\SysWOW64\ServeHost.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
File opened for modification C:\Windows\SysWOW64\ntabhor.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{ABEC6103-F6AC-43A3-834F-FB03FBA339A2} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BB936323-19FA-4521-BA29-ECA6A121BC78} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BB936323-19FA-4521-BA29-ECA6A121BC78}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D157330A-9EF3-49F8-9A67-4141AC41ADD4}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1B0E7716-898E-48CC-9690-4E338E8DE1D3}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6231D512-E4A4-4DF2-BE62-5B8F0EE348EF} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D157330A-9EF3-49F8-9A67-4141AC41ADD4} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1B0E7716-898E-48CC-9690-4E338E8DE1D3} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6231D512-E4A4-4DF2-BE62-5B8F0EE348EF}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{ABEC6103-F6AC-43A3-834F-FB03FBA339A2}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B83FC273-3522-4CC6-92EC-75CC86678DA4} C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B83FC273-3522-4CC6-92EC-75CC86678DA4}\Compatibility Flags = "1024" C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\zwsw.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /u /s "C:\Program Files (x86)\SearchNet\SNHpr.dll"

C:\Users\Admin\AppData\Local\Temp\rnq4894.tmp

C:\Users\Admin\AppData\Local\Temp\rnq4894.tmp

C:\Users\Admin\AppData\Local\Temp\48D2\48D2.exe

"C:\Users\Admin\AppData\Local\Temp\48D2\48D2.exe" 00000402

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\rnq47F6.tmp

MD5 bf503cb6fe413cb3ba2ebda4ca0d96f8
SHA1 40f3e827c2ef381e894cb1e592ef08f0ce0277e5
SHA256 fafd103b6fab2b2b243284bdcfcccb2bea87f66fac4cfbc072eef84d72bf4eaf
SHA512 bc0ec882d90acbb215fb4d89a7c138a79f6cc46736fc56f870297069b15f3bfda0b6fdf162c67a4fe8211c8419e520c2e25c91cbe22bec307690c042c2a85788

memory/1944-0-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1944-6-0x0000000010000000-0x0000000010019000-memory.dmp

memory/1944-16-0x0000000010000000-0x0000000010019000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rnq4894.tmp

MD5 34287b9bad575dfe21ce5364755b63af
SHA1 15503e83525a14ac31058eb01850f6177a72a706
SHA256 27edccdf0def484aa1727d1c6883a9fa1b243b4d55e784b221ae39f68eb6b95f
SHA512 5f7595616fb9188c9f0032c215d1d822de6396895e0f8a3a0f8de491a91974f93b6244149d36331e79226891ec512c1287f9039c606000da2df44980244478eb

memory/1944-23-0x0000000000400000-0x000000000048E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\48D2\48D2.exe

MD5 b9d4e392e8ac6a4420f126cc88d8c0c1
SHA1 3fa9755060979a13973927906222a4929bb4c80f
SHA256 3d20d973651546be8d370ff9013bbdc03282808a212731b92852f0b789634064
SHA512 03fe62e90efaa0cf064c335d7dd4df912f738a85726eb77269687f398511b883400eb0b95d3a8158d2a5b7fec37e073bbde754a5b53e17732b18f667d9960128

C:\Users\Admin\AppData\Local\Temp\48D2\cdnprh.dll

MD5 9076a436c1a5cfdc687714982a6cb86f
SHA1 66357580e2264f23648714254941b7a61d214237
SHA256 000d138eec71e8c16d40a9930c3f0939f7608175f68588d34c07f3a74e71dbde
SHA512 4956ddaabb0fa9a783012102d069c3ee05fa64f25bc9c02b4ff86f15e26b0abb5ce9aa5cdfc3a4844a68123eac64784d4b20c774de0d36aa0b71e35e97c3b834

C:\Users\Admin\AppData\Local\Temp\48D2\cdnins.dll

MD5 1f2d2dbf570ecc45a9e2ce45f264199f
SHA1 bf0656f98e26754f48eb5908319067641ae51d8d
SHA256 766ebfa9689728c545a45cc82cce611a9343bc544fc712dc31881d0f2854296c
SHA512 96e41545336d21bf289d203a56e3bf27ed4d3abcbd23332a590f38adc6568a81f3d10f129539e4efdd751be4e02a7d95052b455c04b6ba0a11c8d4c21a2411a0

C:\Users\Admin\AppData\Local\Temp\48D2\src.dat

MD5 3ab47841cbacd4f95fcc14e5adb758be
SHA1 1e8c5f3d741f94f5c85afe4af77d9ce2ddf9e19c
SHA256 c7c926fd1865f3c2dccb3ec9bd8aac72da8c80036df874e38fb2644159d6f381
SHA512 51e633fcf74383e72a11b266e500c440062a9760850c3e6ac80ab1ae8673cc9428b913cd3c8961a46fb854d561b2eccfb30077b9c3f68706b87924b6db38e997

Analysis: behavioral22

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\xint.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader First Stage

Description Indicator Process Target
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\xint.exe

Processes

C:\Users\Admin\AppData\Local\Temp\xint.exe

"C:\Users\Admin\AppData\Local\Temp\xint.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2228 -ip 2228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 724

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/2228-0-0x0000000000400000-0x0000000000648000-memory.dmp

memory/2228-1-0x00000000007C0000-0x00000000007C1000-memory.dmp

memory/2228-2-0x0000000000820000-0x0000000000821000-memory.dmp

memory/2228-3-0x0000000000400000-0x0000000000648000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ha_xint4.3_lrh.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\ha_xint4.3_lrh.exe

"C:\Users\Admin\AppData\Local\Temp\ha_xint4.3_lrh.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 63.141.182.52.in-addr.arpa udp

Files

memory/1644-0-0x0000000000400000-0x00000000004AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsh57C7.tmp\System.dll

MD5 d4d09da0218ba046a66a294f0cca9dfe
SHA1 417b1acdeb0a4de6ac752a93080ca5b9164eb44b
SHA256 9090e47d239aa1da9598a483861165e0153c01ad9ff9d65cb6c0f4497a1da5b3
SHA512 3bc9a65842301dab56c139cc5a3457158d37ef294583728c93da1e11ae457df9551b0f8fbd03d5ea3058f3bc794d0ede57ea3efd5d663b45d25647a39cd955bf

C:\Users\Admin\AppData\Local\Temp\nsh57C7.tmp\InstallOptions.dll

MD5 83304a78d2b6ea45ea8404f4cd78721f
SHA1 d5c5d19653c751c08579dd094bcc9fef1841af00
SHA256 92344973083c0a5d8f5732814c1315124e8e0a2f1ed912583a081f95f7549414
SHA512 94076cc935927925641d668c19b389d007ff7e8623f2afe706fc73d1ecb97210577a828a727404b200d9870e14b23d6bd047de9201d629e7443a929c0740c67e

C:\Users\Admin\AppData\Local\Temp\nsh57C7.tmp\ioSpecial.ini

MD5 ea2f0663b56d1eb35841a17dea89922a
SHA1 8ddb65ab4d588e64d114c7d85641d94214ef703e
SHA256 bc9a11b3ad5ca2fd705e0aee0f101e1b1a5caf17be18885dac2418d5a8d566e4
SHA512 9314ceaad2838564abd0c556856eae34af6a45653d658c18188790c388c1fa8a563556148b77ce2bde7bc6f6f4201b43f5f0d423c3726c3debe0565ab9294392

memory/1644-100-0x0000000000400000-0x00000000004AC000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20231129-en

Max time kernel

121s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 224

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20240419-en

Max time kernel

117s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\uninst.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\uninst.exe

"C:\Users\Admin\AppData\Local\Temp\uninst.exe"

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\

Network

N/A

Files

memory/2012-0-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/2012-2-0x00000000009A0000-0x0000000000A4C000-memory.dmp

memory/2012-1-0x00000000009A0000-0x0000000000A4C000-memory.dmp

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

MD5 509b8d796e4375ae69a42dfbdbd25059
SHA1 21d6f6ac9bb93303f8b4863f7d0a5cef51b81612
SHA256 204b4026a0f568a996b4e8da328fddba2f9bb99563fd1ee3d912f1304bc42daa
SHA512 37a91867a6bc295f49acb801b3b3af2784f0dd1abe63e6a144900e8246b4d256254aa9f065c133764ba81154c6f07fb8bcf1a461c9c1a1c7e85ec4671ae5b12a

memory/2012-10-0x0000000002930000-0x00000000029DC000-memory.dmp

memory/2012-13-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/2432-12-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/2432-18-0x0000000000350000-0x00000000003FC000-memory.dmp

memory/2432-24-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/2432-26-0x0000000000400000-0x00000000004AC000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\uninst.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\uninst.exe

"C:\Users\Admin\AppData\Local\Temp\uninst.exe"

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp

Files

memory/4924-0-0x0000000000400000-0x00000000004AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

MD5 509b8d796e4375ae69a42dfbdbd25059
SHA1 21d6f6ac9bb93303f8b4863f7d0a5cef51b81612
SHA256 204b4026a0f568a996b4e8da328fddba2f9bb99563fd1ee3d912f1304bc42daa
SHA512 37a91867a6bc295f49acb801b3b3af2784f0dd1abe63e6a144900e8246b4d256254aa9f065c133764ba81154c6f07fb8bcf1a461c9c1a1c7e85ec4671ae5b12a

memory/1932-8-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/4924-6-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/1932-14-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/1932-16-0x0000000000400000-0x00000000004AC000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20240611-en

Max time kernel

121s

Max time network

127s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\非常世纪资源网.url

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\非常世纪资源网.url

Network

N/A

Files

memory/836-0-0x0000000000180000-0x0000000000181000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20240221-en

Max time kernel

140s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ha_xint4.3_lrh.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\ha_xint4.3_lrh.exe

"C:\Users\Admin\AppData\Local\Temp\ha_xint4.3_lrh.exe"

Network

N/A

Files

memory/2192-0-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/2192-1-0x00000000008A0000-0x000000000094C000-memory.dmp

memory/2192-2-0x00000000008A0000-0x000000000094C000-memory.dmp

\Users\Admin\AppData\Local\Temp\nso175A.tmp\System.dll

MD5 d4d09da0218ba046a66a294f0cca9dfe
SHA1 417b1acdeb0a4de6ac752a93080ca5b9164eb44b
SHA256 9090e47d239aa1da9598a483861165e0153c01ad9ff9d65cb6c0f4497a1da5b3
SHA512 3bc9a65842301dab56c139cc5a3457158d37ef294583728c93da1e11ae457df9551b0f8fbd03d5ea3058f3bc794d0ede57ea3efd5d663b45d25647a39cd955bf

C:\Users\Admin\AppData\Local\Temp\nso175A.tmp\ioSpecial.ini

MD5 d3f8b066538924ac38299898818e29a2
SHA1 4b709597601de76a0fda35ac54237b1d968d46f3
SHA256 184566dd472bcbb753b63c11f0f221cbf28b33d0a8756def981b0fbd457cce9a
SHA512 8c51dba3851c89b7968d7d6a01edce626fd2dc51b4001775fc12ce067a8da85cab250d8705824e4b97f2b96506bffde44e88f2b1adb9b7278713bddb0a0c9b19

\Users\Admin\AppData\Local\Temp\nso175A.tmp\InstallOptions.dll

MD5 83304a78d2b6ea45ea8404f4cd78721f
SHA1 d5c5d19653c751c08579dd094bcc9fef1841af00
SHA256 92344973083c0a5d8f5732814c1315124e8e0a2f1ed912583a081f95f7549414
SHA512 94076cc935927925641d668c19b389d007ff7e8623f2afe706fc73d1ecb97210577a828a727404b200d9870e14b23d6bd047de9201d629e7443a929c0740c67e

memory/2192-102-0x0000000000400000-0x00000000004AC000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20240508-en

Max time kernel

117s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 244

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20240611-en

Max time kernel

119s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsweb.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsweb.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsweb.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 240

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20240508-en

Max time kernel

117s

Max time network

118s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\ReplacingNotepad.bat"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\notepad.exe C:\Windows\system32\cmd.exe N/A
File created C:\Windows\System32\DllCache\notepad.exe C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Windows\System32\notepad.exe C:\Windows\system32\cmd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\notepad.exe.orig C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Windows\notepad.exe.orig C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Windows\notepad.exe C:\Windows\system32\cmd.exe N/A
File created C:\Windows\notepad.exe C:\Windows\system32\cmd.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\ReplacingNotepad.bat"

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\非常世纪资源网.url

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\非常世纪资源网.url

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240611-en

Max time kernel

128s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2968 wrote to memory of 1536 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2968 wrote to memory of 1536 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2968 wrote to memory of 1536 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1536 -ip 1536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240611-en

Max time kernel

141s

Max time network

135s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4296 wrote to memory of 1548 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4296 wrote to memory of 1548 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4296 wrote to memory of 1548 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1548 -ip 1548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240611-en

Max time kernel

134s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsweb.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4772 wrote to memory of 3492 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4772 wrote to memory of 3492 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4772 wrote to memory of 3492 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsweb.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsweb.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3492 -ip 3492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 664

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240611-en

Max time kernel

135s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\BaiduInstall = "C:\\Windows\\system32\\rundll32.exe C:\\PROGRA~2\\baidu\\bar\\BaiduBar.dll,Install" C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Àq* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\{* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\è|* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File created C:\Program Files (x86)\baidu\bar\BDBar_tmp\img\imglist.bmp C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\BaiduBar.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\PROGRA~2\baidu\bar\BaiduBar.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\€l* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\@n* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\˜* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\àÞ‹u C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\xhŒwð¡ˆwÀ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\¨º|w C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\€s* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File created C:\Program Files (x86)\baidu\bar\BDBar_tmp\img\logo.bmp C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ð* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File created C:\PROGRA~2\baidu\bar\BaiduBar.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Øt* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\img\logo.bmp C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\Àj* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\8z* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\@~* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ð€* C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\0… C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\img\imglist.bmp C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File created C:\Program Files (x86)\baidu\bar\BDBar_tmp\baidubar.dat C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File created C:\Program Files (x86)\baidu\bar\BDBar_tmp\BaiduBar.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\·;~w°ý~ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\baidubar.dat C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\xhŒwð¡ˆw C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A
File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ÿÿ C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\123.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3148 -ip 3148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 740

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

C:\Program Files (x86)\baidu\bar\BDBar_tmp\BaiduBar.dll

MD5 0c8ed82bce60e5e2860d9daa28289267
SHA1 5ea9dcfadc426463c51e0abfc736a42dfc31f3e9
SHA256 89bc3949eb1ab805b49f2699f0623796997ba7bf0f5acf9402f90ae5cd630d13
SHA512 2a6b90d1ee12d88a9866b774de5b52b329beebbb9ce0c1655455020aeaddd0824cd3c38804e76f777b81fa5b149744b392ea8f904ba2eb71c6db779a0ef85830

memory/3148-16-0x00000000021F0000-0x000000000228C000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240611-en

Max time kernel

128s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe"

Signatures

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\band_s.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A
File created C:\Windows\SysWOW64\band_s.dll C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\regsvr32.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CABF6E-22D8-4733-A08F-9C35A1A3679C} C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CABF6E-22D8-4733-A08F-9C35A1A3679C}\send = "1" C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CABF6E-22D8-4733-A08F-9C35A1A3679C}\loop = "1" C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79CABF6E-22D8-4733-A08F-9C35A1A3679C}\name = "8200" C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3336 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3336 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3336 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\noui.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 -s C:\Windows\system32\band_s.dll

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1128 -ip 1128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 664

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp

Files

C:\Windows\SysWOW64\band_s.dll

MD5 140ca271c5d12f031ab2f3cbc98ee19d
SHA1 034af3cf6762c155b5a104c242b68d7c5a7dd76f
SHA256 b5187fb26ae50a447d935bcd618a721dc95e0d5d2eb74a38525a8bae6aa39e35
SHA512 cf87048cd15117412c6bc0ced68923abd85cb940ffddc75a66651337340d41f98a1e8a0e19f5394031d4d4da4109399ab56a92da0205236ceeb3d1065ba1009b

memory/3336-3-0x0000000000400000-0x0000000000444000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240508-en

Max time kernel

54s

Max time network

63s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ReplacingNotepad.bat"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DllCache\notepad.exe C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Windows\System32\notepad.exe C:\Windows\system32\cmd.exe N/A
File created C:\Windows\System32\notepad.exe C:\Windows\system32\cmd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\notepad.exe.orig C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Windows\notepad.exe.orig C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Windows\notepad.exe C:\Windows\system32\cmd.exe N/A
File created C:\Windows\notepad.exe C:\Windows\system32\cmd.exe N/A

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ReplacingNotepad.bat"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20240508-en

Max time kernel

119s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\xint.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader First Stage

Description Indicator Process Target
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\xint.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1632 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\xint.exe C:\Windows\SysWOW64\WerFault.exe
PID 1632 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\xint.exe C:\Windows\SysWOW64\WerFault.exe
PID 1632 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\xint.exe C:\Windows\SysWOW64\WerFault.exe
PID 1632 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\xint.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\xint.exe

"C:\Users\Admin\AppData\Local\Temp\xint.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 324

Network

N/A

Files

memory/1632-0-0x0000000000400000-0x0000000000648000-memory.dmp

memory/1632-1-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1632-2-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1632-3-0x0000000000400000-0x0000000000648000-memory.dmp

memory/1632-4-0x0000000000230000-0x0000000000231000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1916 wrote to memory of 2264 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1916 wrote to memory of 2264 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1916 wrote to memory of 2264 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2264 -ip 2264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 624

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-07-04 01:14

Reported

2024-07-04 01:17

Platform

win7-20240508-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 224

Network

N/A

Files

N/A