Malware Analysis Report

2025-01-02 07:26

Sample ID 240914-dvy1xsthql
Target f40a6510b3f8dd3a21464be0132f8090N
SHA256 7eb237e18ea11289f5266015dee0556bb3842bb02027c19bfab1bb32e203192a
Tags
floxif backdoor discovery persistence privilege_escalation trojan upx evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7eb237e18ea11289f5266015dee0556bb3842bb02027c19bfab1bb32e203192a

Threat Level: Known bad

The file f40a6510b3f8dd3a21464be0132f8090N was found to be: Known bad.

Malicious Activity Summary

floxif backdoor discovery persistence privilege_escalation trojan upx evasion

Floxif, Floodfix

Modifies visiblity of hidden/system files in Explorer

Detects Floxif payload

Event Triggered Execution: AppInit DLLs

Executes dropped EXE

Loads dropped DLL

UPX packed file

ACProtect 1.3x - 1.4x DLL software

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-14 03:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-14 03:20

Reported

2024-09-14 03:22

Platform

win7-20240903-en

Max time kernel

90s

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe"

Signatures

Floxif, Floodfix

backdoor trojan floxif

Detects Floxif payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A

Event Triggered Execution: AppInit DLLs

persistence privilege_escalation

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\symsrv.dll \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3012 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 3012 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 3012 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 3012 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 2732 wrote to memory of 2972 N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 2732 wrote to memory of 2972 N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 2732 wrote to memory of 2972 N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 2732 wrote to memory of 2972 N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

Processes

C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe

"C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe"

\??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

\??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

Network

N/A

Files

memory/3012-0-0x0000000000400000-0x000000000041F000-memory.dmp

\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

MD5 43c41ff496c9ebfaec5c9bfac304324e
SHA1 9cee50003c114869ffa5f5e24cd27afb3f5f3d2d
SHA256 2cd0788a40dde4e8090d8e6ec286e7ffd2fec66a20aeab860c5c3aba9a98c87e
SHA512 156f62c749b6a1488193812117eeeeb517d63b7b95788b73697aea9d4b43acd7c82d3d578d474b8f92ac9a9606c73efe8c8eb393c89c47a914ca70b0870c9b74

memory/3012-8-0x0000000000340000-0x000000000035F000-memory.dmp

\Program Files\Common Files\System\symsrv.dll

MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

memory/2732-15-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A1D26E2\4B33A6CAAC.tmp

MD5 97c3a84fbdbda15c953b8ec31d0b35da
SHA1 e0e7c2ffa7c05c06349511a1147435c5215e02e9
SHA256 0ce150732f511567362779a52f4f12160ae1dfad49ab3a620be49647b3af0771
SHA512 ac8624e13d952ace856e08dcbe4a245093f151cabf395b5fdcf521ec350060de012fa4754e3f9e3b0ab0a971743e4e8c6909857c29d78be5734a7bb92fd319d4

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 4a06019836eaa91dd3a90042ab9d0e60
SHA1 392c7985f7007e4908f6ceefbe39ae014d5e57a1
SHA256 5af76d57c9573c0e242c8897898280c4fe325d5dd557bf9a90e093d015154112
SHA512 23151d58f6a9f1743af801352cbfa130f4ffcaea03637eaeef51f785f2ac1ea1dbf923734defa983f091bb69b13a869ff22b35dcfd82e5865a892678db6ece57

memory/3012-25-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2732-23-0x0000000000470000-0x000000000048F000-memory.dmp

memory/2972-28-0x0000000010000000-0x0000000010030000-memory.dmp

memory/2732-33-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2732-32-0x0000000010000000-0x0000000010030000-memory.dmp

memory/2972-36-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2972-35-0x0000000010000000-0x0000000010030000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-14 03:20

Reported

2024-09-14 03:22

Platform

win10v2004-20240802-en

Max time kernel

120s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe"

Signatures

Floxif, Floodfix

backdoor trojan floxif

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

Detects Floxif payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\symsrv.dll \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Resources\Themes\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Resources\Themes\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\themes\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2992 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 2992 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 2992 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 2992 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2992 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2992 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 3192 wrote to memory of 400 N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 3192 wrote to memory of 400 N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 3192 wrote to memory of 400 N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 
PID 1504 wrote to memory of 4508 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 1504 wrote to memory of 4508 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 1504 wrote to memory of 4508 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 3192 wrote to memory of 3148 N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  C:\Windows\Resources\Themes\icsys.icn.exe
PID 3192 wrote to memory of 3148 N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  C:\Windows\Resources\Themes\icsys.icn.exe
PID 3192 wrote to memory of 3148 N/A \??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe  C:\Windows\Resources\Themes\icsys.icn.exe
PID 4508 wrote to memory of 2776 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4508 wrote to memory of 2776 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4508 wrote to memory of 2776 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2776 wrote to memory of 1416 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2776 wrote to memory of 1416 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2776 wrote to memory of 1416 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 1416 wrote to memory of 2220 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 1416 wrote to memory of 2220 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 1416 wrote to memory of 2220 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe

"C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090N.exe"

\??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

c:\users\admin\appdata\local\temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/2992-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f40a6510b3f8dd3a21464be0132f8090n.exe 

MD5 43c41ff496c9ebfaec5c9bfac304324e
SHA1 9cee50003c114869ffa5f5e24cd27afb3f5f3d2d
SHA256 2cd0788a40dde4e8090d8e6ec286e7ffd2fec66a20aeab860c5c3aba9a98c87e
SHA512 156f62c749b6a1488193812117eeeeb517d63b7b95788b73697aea9d4b43acd7c82d3d578d474b8f92ac9a9606c73efe8c8eb393c89c47a914ca70b0870c9b74

memory/3192-8-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Program Files\Common Files\System\symsrv.dll

MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

memory/3192-14-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A1D26E2\7E481C0C78.tmp

MD5 97c3a84fbdbda15c953b8ec31d0b35da
SHA1 e0e7c2ffa7c05c06349511a1147435c5215e02e9
SHA256 0ce150732f511567362779a52f4f12160ae1dfad49ab3a620be49647b3af0771
SHA512 ac8624e13d952ace856e08dcbe4a245093f151cabf395b5fdcf521ec350060de012fa4754e3f9e3b0ab0a971743e4e8c6909857c29d78be5734a7bb92fd319d4

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 4a06019836eaa91dd3a90042ab9d0e60
SHA1 392c7985f7007e4908f6ceefbe39ae014d5e57a1
SHA256 5af76d57c9573c0e242c8897898280c4fe325d5dd557bf9a90e093d015154112
SHA512 23151d58f6a9f1743af801352cbfa130f4ffcaea03637eaeef51f785f2ac1ea1dbf923734defa983f091bb69b13a869ff22b35dcfd82e5865a892678db6ece57

memory/400-29-0x0000000010000000-0x0000000010030000-memory.dmp

memory/400-28-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Windows\Resources\Themes\explorer.exe

MD5 1295033f461a655b1a062a5781c96278
SHA1 70289b020bebcb5b4f8be934b4284d7b65658ac2
SHA256 8dd39e59eff0f8881d68b51f6cd8ead530acc66c77aef6c53cec05a0f3d572ff
SHA512 d4008cc66e327f47323c114b12ad43babac8fce0db436e3d08434b3bf51cc349d8a60b724ae869f447d07ab2bb31bba1e00e3a5269bd4948e04216e92aa8ff9b

memory/3148-47-0x0000000000400000-0x000000000041F000-memory.dmp

memory/400-50-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Windows\Resources\spoolsv.exe

MD5 6c47b7fb0d910928176d8d6a72b8e32a
SHA1 2d5041a18a5af3cbe73167f534fb93143d262852
SHA256 2ac7d3ca4053a3b0990d7a66eb5c86a58fa692409ec8d46aea91a29f581516d8
SHA512 fc34b68ecdd02446ed4186e81f6a5f9a9392d54dea075db826fd6c7014b3a844be11ef00291112a49388ff83a6d4b2ecf7a2eee15292b6c6f6bce059ae30d10a

C:\Windows\Resources\svchost.exe

MD5 2170d1f3a8c0776348bcf5663ef02115
SHA1 7c59ede4f9e56fcb7c77c805aab2b12ab68d11f1
SHA256 7259b18fa7b501b2e160b836baff4c036102116313b247fbf9502d4e07a3d130
SHA512 0849daad4dcf473838445bad7fdb5c667fc3857739ab38d8c222db961cd88afa56d273234f72785b8809b1bdda6d82079598def3d7eb922dfcdc72d08dac47fe

memory/3148-66-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3192-64-0x0000000010000000-0x0000000010030000-memory.dmp

memory/3192-63-0x0000000000400000-0x000000000041F000-memory.dmp

memory/400-51-0x0000000010000000-0x0000000010030000-memory.dmp

memory/2220-76-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2776-77-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1504-78-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2992-79-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4508-80-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1416-81-0x0000000000400000-0x000000000041F000-memory.dmp