Malware Analysis Report

2024-10-19 01:52

Sample ID 240831-fwnyfsxelj
Target b5b559ae20ec80c26ec50afd2d077f53.zip
SHA256 82aa9a86e40c08cd9fb8a692485ed58cd00e737747da32b80b7cd93809ef7de5
Tags
tofsee discovery evasion execution persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82aa9a86e40c08cd9fb8a692485ed58cd00e737747da32b80b7cd93809ef7de5

Threat Level: Known bad

The file b5b559ae20ec80c26ec50afd2d077f53.zip was found to be: Known bad.

Malicious Activity Summary

tofsee discovery evasion execution persistence privilege_escalation trojan

Tofsee

Windows security bypass

Sets service image path in registry

Modifies Windows Firewall

Creates new service(s)

Executes dropped EXE

Deletes itself

Checks computer location settings

Suspicious use of SetThreadContext

Launches sc.exe

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-31 05:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-31 05:13

Reported

2024-08-31 05:16

Platform

win7-20240704-en

Max time kernel

149s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\vziqrtdq = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\vziqrtdq\ImagePath = "C:\\Windows\\SysWOW64\\vziqrtdq\\qtrmgnxh.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2544 set thread context of 1788 N/A C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1848 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 1848 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 1848 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 1848 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 1848 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 1848 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 1848 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 1848 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 1848 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 1848 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\netsh.exe
PID 1848 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\netsh.exe
PID 1848 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\netsh.exe
PID 1848 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\netsh.exe
PID 2544 wrote to memory of 1788 N/A C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe C:\Windows\SysWOW64\svchost.exe
PID 2544 wrote to memory of 1788 N/A C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe C:\Windows\SysWOW64\svchost.exe
PID 2544 wrote to memory of 1788 N/A C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe C:\Windows\SysWOW64\svchost.exe
PID 2544 wrote to memory of 1788 N/A C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe C:\Windows\SysWOW64\svchost.exe
PID 2544 wrote to memory of 1788 N/A C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe C:\Windows\SysWOW64\svchost.exe
PID 2544 wrote to memory of 1788 N/A C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe

"C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vziqrtdq\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qtrmgnxh.exe" C:\Windows\SysWOW64\vziqrtdq\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create vziqrtdq binPath= "C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe /d\"C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description vziqrtdq "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start vziqrtdq

C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe

C:\Windows\SysWOW64\vziqrtdq\qtrmgnxh.exe /d"C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.231.239.246:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 8.8.8.8:53 defeatwax.ru udp
US 52.101.40.26:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 98.136.96.75:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 173.194.69.26:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/1848-1-0x0000000000270000-0x0000000000370000-memory.dmp

memory/1848-2-0x0000000000020000-0x0000000000033000-memory.dmp

memory/1848-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qtrmgnxh.exe

MD5 ab0059da90393f4fc4c2426218fb257e
SHA1 40c1160821a06a925c1d49bc5c8f522a4987fb47
SHA256 f5cacd76a7cc49cbf3f72e0b1f7c8c72b4c4ef10f3bf26ccd10f7ffc81eca8bd
SHA512 4b7b2f20fc5d1a0ae0625d09c8ad675590f1cd97b37483e6d47a1143fcb9d6470f936bda5cc68fcf71f782b1e8ac242381c3fc1c1cf07060bfe38c0f66be227c

memory/1848-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/1848-9-0x0000000000020000-0x0000000000033000-memory.dmp

memory/1848-8-0x0000000000400000-0x0000000000870000-memory.dmp

memory/1788-16-0x0000000000080000-0x0000000000095000-memory.dmp

memory/1788-14-0x0000000000080000-0x0000000000095000-memory.dmp

memory/1788-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1788-11-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2544-17-0x0000000000400000-0x0000000000870000-memory.dmp

memory/1788-18-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-31 05:13

Reported

2024-08-31 05:16

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\oodqwbmn\ImagePath = "C:\\Windows\\SysWOW64\\oodqwbmn\\tadbccsg.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4156 set thread context of 1696 N/A C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2676 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 2676 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 2676 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 2676 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 2676 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 2676 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 2676 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 2676 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 2676 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\sc.exe
PID 2676 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\netsh.exe
PID 2676 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\netsh.exe
PID 2676 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe C:\Windows\SysWOW64\netsh.exe
PID 4156 wrote to memory of 1696 N/A C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe C:\Windows\SysWOW64\svchost.exe
PID 4156 wrote to memory of 1696 N/A C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe C:\Windows\SysWOW64\svchost.exe
PID 4156 wrote to memory of 1696 N/A C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe C:\Windows\SysWOW64\svchost.exe
PID 4156 wrote to memory of 1696 N/A C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe C:\Windows\SysWOW64\svchost.exe
PID 4156 wrote to memory of 1696 N/A C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe

"C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\oodqwbmn\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tadbccsg.exe" C:\Windows\SysWOW64\oodqwbmn\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create oodqwbmn binPath= "C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe /d\"C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description oodqwbmn "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start oodqwbmn

C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe

C:\Windows\SysWOW64\oodqwbmn\tadbccsg.exe /d"C:\Users\Admin\AppData\Local\Temp\072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2676 -ip 2676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 1044

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4156 -ip 4156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 512

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
AU 20.70.246.20:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.11.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 20.246.70.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.204.79:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 74.125.143.27:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/2676-1-0x0000000000A20000-0x0000000000B20000-memory.dmp

memory/2676-2-0x00000000001E0000-0x00000000001F3000-memory.dmp

memory/2676-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tadbccsg.exe

MD5 737506048d5a9ca5f3280765a46199c9
SHA1 5043549b31f6c2ce0c8e08549f4918b63aecdbef
SHA256 0bccc7807359c6bfa4a81d137948086adaf9e5ce566cd7f83ae5042877bd537d
SHA512 5418a190e281cc41ed08bf329c36c25fd055e747e2bf79f43ad1b8fcb020c89e013893ae29bc34a0fce81891e82354cec8b0a29f6adcead3113479dfa66964d3

memory/2676-8-0x0000000000400000-0x0000000000870000-memory.dmp

memory/2676-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2676-9-0x00000000001E0000-0x00000000001F3000-memory.dmp

memory/1696-11-0x0000000000E20000-0x0000000000E35000-memory.dmp

memory/4156-14-0x0000000000400000-0x0000000000870000-memory.dmp

memory/4156-15-0x0000000000400000-0x0000000000870000-memory.dmp

memory/1696-13-0x0000000000E20000-0x0000000000E35000-memory.dmp

memory/1696-16-0x0000000000E20000-0x0000000000E35000-memory.dmp