Malware Analysis Report

2024-10-19 01:51

Sample ID 240831-z2g7mswblh
Target d3ad591f0689b854fe488a00451cafca5f4497ca7ca77718ee48195ad213d830
SHA256 d3ad591f0689b854fe488a00451cafca5f4497ca7ca77718ee48195ad213d830
Tags
tofsee discovery evasion execution persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d3ad591f0689b854fe488a00451cafca5f4497ca7ca77718ee48195ad213d830

Threat Level: Known bad

The file d3ad591f0689b854fe488a00451cafca5f4497ca7ca77718ee48195ad213d830 was found to be: Known bad.

Malicious Activity Summary

tofsee discovery evasion execution persistence privilege_escalation trojan

Windows security bypass

Tofsee

Creates new service(s)

Modifies Windows Firewall

Sets service image path in registry

Deletes itself

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Launches sc.exe

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-31 21:12

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-31 21:12

Reported

2024-08-31 21:15

Platform

win7-20240704-en

Max time kernel

144s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\owbnmryg = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\owbnmryg\ImagePath = "C:\\Windows\\SysWOW64\\owbnmryg\\gxqtanzy.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3020 set thread context of 1408 N/A C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2152 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 2152 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 2152 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 2152 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 2152 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 2152 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 2152 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 2152 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 2152 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\netsh.exe
PID 2152 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\netsh.exe
PID 2152 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\netsh.exe
PID 2152 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\netsh.exe
PID 3020 wrote to memory of 1408 N/A C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe C:\Windows\SysWOW64\svchost.exe
PID 3020 wrote to memory of 1408 N/A C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe C:\Windows\SysWOW64\svchost.exe
PID 3020 wrote to memory of 1408 N/A C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe C:\Windows\SysWOW64\svchost.exe
PID 3020 wrote to memory of 1408 N/A C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe C:\Windows\SysWOW64\svchost.exe
PID 3020 wrote to memory of 1408 N/A C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe C:\Windows\SysWOW64\svchost.exe
PID 3020 wrote to memory of 1408 N/A C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe

"C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\owbnmryg\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gxqtanzy.exe" C:\Windows\SysWOW64\owbnmryg\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create owbnmryg binPath= "C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe /d\"C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description owbnmryg "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start owbnmryg

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe

C:\Windows\SysWOW64\owbnmryg\gxqtanzy.exe /d"C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.236.44.162:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.41.24:25 microsoft-com.mail.protection.outlook.com tcp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.228.110:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 108.177.119.27:25 smtp.google.com tcp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
AU 43.231.4.7:443 tcp

Files

memory/2152-0-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2152-2-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2152-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2152-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gxqtanzy.exe

MD5 62779d54a2d33fca1ae9f04b753af933
SHA1 2ab82983fd5a9f706ebbf7007b3978a06dc712c9
SHA256 d7b57f8f1346b4b2300a0e61799200941a885725a79bcb3c06543a3653c6f25b
SHA512 d3b75544e15f4e1ec0266b1e12ba5a48d8ed13ae35df5352f270c94257189995a64dd3516409fe2d639a73d21212d05dcd9fad1d8d40d6d67a22b1c5d34a3b64

memory/2152-9-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3020-11-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3020-10-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2152-8-0x00000000050E0000-0x00000000050F1000-memory.dmp

memory/1408-15-0x0000000000080000-0x0000000000095000-memory.dmp

memory/1408-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1408-12-0x0000000000080000-0x0000000000095000-memory.dmp

memory/1408-20-0x0000000000080000-0x0000000000095000-memory.dmp

memory/3020-19-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3020-18-0x00000000050E0000-0x00000000050F1000-memory.dmp

memory/1408-21-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-31 21:12

Reported

2024-08-31 21:15

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\eutqcklu\ImagePath = "C:\\Windows\\SysWOW64\\eutqcklu\\ehppnlpy.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2052 set thread context of 4524 N/A C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4148 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 4148 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 4148 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 4148 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 4148 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 4148 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\cmd.exe
PID 4148 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 4148 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 4148 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 4148 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 4148 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 4148 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 4148 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 4148 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 4148 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\sc.exe
PID 4148 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\netsh.exe
PID 4148 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\netsh.exe
PID 4148 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe C:\Windows\SysWOW64\netsh.exe
PID 2052 wrote to memory of 4524 N/A C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe C:\Windows\SysWOW64\svchost.exe
PID 2052 wrote to memory of 4524 N/A C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe C:\Windows\SysWOW64\svchost.exe
PID 2052 wrote to memory of 4524 N/A C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe C:\Windows\SysWOW64\svchost.exe
PID 2052 wrote to memory of 4524 N/A C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe C:\Windows\SysWOW64\svchost.exe
PID 2052 wrote to memory of 4524 N/A C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe

"C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\eutqcklu\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ehppnlpy.exe" C:\Windows\SysWOW64\eutqcklu\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create eutqcklu binPath= "C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe /d\"C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description eutqcklu "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start eutqcklu

C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe

C:\Windows\SysWOW64\eutqcklu\ehppnlpy.exe /d"C:\Users\Admin\AppData\Local\Temp\cc405e27cf3c45f22534764ed6c2c3d7dc46264b4c275cfc53b3cf6707c211a5.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 42.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.236.44.162:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.40.26:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 162.44.236.20.in-addr.arpa udp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.94:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 108.177.127.27:25 smtp.google.com tcp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 udp

Files

memory/4148-0-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4148-1-0x00000000009C0000-0x00000000009C1000-memory.dmp

memory/4148-2-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4148-3-0x00000000009D0000-0x00000000009D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ehppnlpy.exe

MD5 eecf8510af28550b7aa5df8f903c279d
SHA1 a6c926a4f91953f34255e24422fa592c5079bf56
SHA256 7f4fddf373a5dd9c609331509354343916dd79281d56397ee63f7dac92e1e622
SHA512 55656236f7a52bd2bda16111c29216fe15e463f39eaef6bb44ed5325c6711efff00e54176859dc0809bde978ffb32044cdaad4adabaa7d130f5eb11504a262ae

memory/2052-7-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2052-8-0x0000000000530000-0x0000000000531000-memory.dmp

memory/4148-12-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4148-11-0x000000005F000000-0x000000005F011000-memory.dmp

memory/4524-13-0x00000000003B0000-0x00000000003C5000-memory.dmp

memory/4524-17-0x00000000003B0000-0x00000000003C5000-memory.dmp

memory/4524-16-0x00000000003B0000-0x00000000003C5000-memory.dmp

memory/2052-20-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4524-21-0x00000000003B0000-0x00000000003C5000-memory.dmp

memory/4524-22-0x00000000003B0000-0x00000000003C5000-memory.dmp