Malware Analysis Report

2024-10-19 01:52

Sample ID 240901-antabathrd
Target 46912015f4e217c84f81982305c8c6d5.zip
SHA256 f8d31e6775488ad2285818fdd4b9bb4f1480a453758a29a3755f4376954e8644
Tags
tofsee discovery evasion execution persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f8d31e6775488ad2285818fdd4b9bb4f1480a453758a29a3755f4376954e8644

Threat Level: Known bad

The file 46912015f4e217c84f81982305c8c6d5.zip was found to be: Known bad.

Malicious Activity Summary

tofsee discovery evasion execution persistence privilege_escalation trojan

Tofsee

Windows security bypass

Creates new service(s)

Modifies Windows Firewall

Sets service image path in registry

Deletes itself

Executes dropped EXE

Checks computer location settings

Suspicious use of SetThreadContext

Launches sc.exe

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Program crash

Event Triggered Execution: Netsh Helper DLL

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-01 00:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-01 00:21

Reported

2024-09-01 00:24

Platform

win7-20240708-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\jibynyjz = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\jibynyjz\ImagePath = "C:\\Windows\\SysWOW64\\jibynyjz\\hepusczw.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\jibynyjz\hepusczw.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2832 set thread context of 2936 N/A C:\Windows\SysWOW64\jibynyjz\hepusczw.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\jibynyjz\hepusczw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1976 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 1976 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\netsh.exe
PID 1976 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\netsh.exe
PID 1976 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\netsh.exe
PID 1976 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\netsh.exe
PID 2832 wrote to memory of 2936 N/A C:\Windows\SysWOW64\jibynyjz\hepusczw.exe C:\Windows\SysWOW64\svchost.exe
PID 2832 wrote to memory of 2936 N/A C:\Windows\SysWOW64\jibynyjz\hepusczw.exe C:\Windows\SysWOW64\svchost.exe
PID 2832 wrote to memory of 2936 N/A C:\Windows\SysWOW64\jibynyjz\hepusczw.exe C:\Windows\SysWOW64\svchost.exe
PID 2832 wrote to memory of 2936 N/A C:\Windows\SysWOW64\jibynyjz\hepusczw.exe C:\Windows\SysWOW64\svchost.exe
PID 2832 wrote to memory of 2936 N/A C:\Windows\SysWOW64\jibynyjz\hepusczw.exe C:\Windows\SysWOW64\svchost.exe
PID 2832 wrote to memory of 2936 N/A C:\Windows\SysWOW64\jibynyjz\hepusczw.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe

"C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jibynyjz\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hepusczw.exe" C:\Windows\SysWOW64\jibynyjz\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create jibynyjz binPath= "C:\Windows\SysWOW64\jibynyjz\hepusczw.exe /d\"C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description jibynyjz "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start jibynyjz

C:\Windows\SysWOW64\jibynyjz\hepusczw.exe

C:\Windows\SysWOW64\jibynyjz\hepusczw.exe /d"C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
NL 20.76.201.171:80 microsoft.com tcp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.40.26:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.106:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 108.177.127.26:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp

Files

memory/1976-1-0x0000000001880000-0x0000000001980000-memory.dmp

memory/1976-2-0x0000000000220000-0x0000000000233000-memory.dmp

memory/1976-4-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hepusczw.exe

MD5 fdc991154b8ce8d2eaaf4743da340702
SHA1 32b53958586bb248ebb4dc03c03cf7641770e62f
SHA256 c39712ba31a2dc6d274bc92d81ec49521fa56616ad3fc76347d779aeb21cfdeb
SHA512 6028addda2bc444d56844599fe9fde3582cbfbd1049825487bd08e5ea93d908777f5ffb573ab7e72765b4a6bfab54585584081a78f6f43b244557aef911ed714

memory/1976-11-0x0000000000400000-0x0000000000415000-memory.dmp

memory/1976-10-0x0000000001880000-0x0000000001980000-memory.dmp

memory/1976-8-0x0000000000400000-0x00000000016BD000-memory.dmp

memory/1976-9-0x0000000000220000-0x0000000000233000-memory.dmp

memory/2936-17-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2936-15-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2936-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2936-12-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2936-19-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2832-18-0x0000000000400000-0x00000000016BD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-01 00:21

Reported

2024-09-01 00:24

Platform

win10v2004-20240802-en

Max time kernel

147s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\naorvvnb\ImagePath = "C:\\Windows\\SysWOW64\\naorvvnb\\jcndolex.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\naorvvnb\jcndolex.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3380 set thread context of 5676 N/A C:\Windows\SysWOW64\naorvvnb\jcndolex.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\naorvvnb\jcndolex.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5548 wrote to memory of 6072 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 5548 wrote to memory of 6072 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 5548 wrote to memory of 6072 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 5548 wrote to memory of 5960 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 5548 wrote to memory of 5960 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 5548 wrote to memory of 5960 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\cmd.exe
PID 5548 wrote to memory of 5928 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 5548 wrote to memory of 5928 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 5548 wrote to memory of 5928 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 5548 wrote to memory of 5824 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 5548 wrote to memory of 5824 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 5548 wrote to memory of 5824 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 5548 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 5548 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 5548 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\sc.exe
PID 5548 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\netsh.exe
PID 5548 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\netsh.exe
PID 5548 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe C:\Windows\SysWOW64\netsh.exe
PID 3380 wrote to memory of 5676 N/A C:\Windows\SysWOW64\naorvvnb\jcndolex.exe C:\Windows\SysWOW64\svchost.exe
PID 3380 wrote to memory of 5676 N/A C:\Windows\SysWOW64\naorvvnb\jcndolex.exe C:\Windows\SysWOW64\svchost.exe
PID 3380 wrote to memory of 5676 N/A C:\Windows\SysWOW64\naorvvnb\jcndolex.exe C:\Windows\SysWOW64\svchost.exe
PID 3380 wrote to memory of 5676 N/A C:\Windows\SysWOW64\naorvvnb\jcndolex.exe C:\Windows\SysWOW64\svchost.exe
PID 3380 wrote to memory of 5676 N/A C:\Windows\SysWOW64\naorvvnb\jcndolex.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe

"C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\naorvvnb\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jcndolex.exe" C:\Windows\SysWOW64\naorvvnb\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create naorvvnb binPath= "C:\Windows\SysWOW64\naorvvnb\jcndolex.exe /d\"C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description naorvvnb "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start naorvvnb

C:\Windows\SysWOW64\naorvvnb\jcndolex.exe

C:\Windows\SysWOW64\naorvvnb\jcndolex.exe /d"C:\Users\Admin\AppData\Local\Temp\29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5548 -ip 5548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 1356

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3380 -ip 3380

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 512

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 quadoil.ru udp
NL 52.111.243.29:443 tcp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 quadoil.ru udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 lakeflex.ru udp
US 8.8.8.8:53 quadoil.ru udp

Files

memory/5548-1-0x00000000016E0000-0x00000000017E0000-memory.dmp

memory/5548-2-0x00000000032C0000-0x00000000032D3000-memory.dmp

memory/5548-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jcndolex.exe

MD5 090c533b8badd6a2f7a80f90fc017e78
SHA1 5a206f2e45dfc29782e0897f1b542ed6499ac00e
SHA256 378ec6cdc5d0af1d08e62551e4bbf068cf602f09de24babbf67fe18f132dbd91
SHA512 f3d38a46fbd2b6a0ee123336ef0784f913f10f3e447c7a645807942ac9d7c42119d525d59a8c2dda2490acf2aef27e4b3648375751128639a463a405c09e48df

memory/5548-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/5548-9-0x00000000032C0000-0x00000000032D3000-memory.dmp

memory/5548-8-0x0000000000400000-0x00000000016BD000-memory.dmp

memory/5676-11-0x0000000001060000-0x0000000001075000-memory.dmp

memory/3380-14-0x0000000000400000-0x00000000016BD000-memory.dmp

memory/5676-13-0x0000000001060000-0x0000000001075000-memory.dmp

memory/5676-15-0x0000000001060000-0x0000000001075000-memory.dmp

memory/3380-16-0x0000000000400000-0x00000000016BD000-memory.dmp