Malware Analysis Report

2025-03-15 06:24

Sample ID 241001-lp64caxald
Target 307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN
SHA256 307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ce
Tags
njrat hacked discovery evasion persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ce

Threat Level: Known bad

The file 307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN was found to be: Known bad.

Malicious Activity Summary

njrat hacked discovery evasion persistence privilege_escalation trojan

njRAT/Bladabindi

Disables Task Manager via registry modification

Modifies Windows Firewall

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Drops startup file

Uses the VBS compiler for execution

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Modifies registry class

Enumerates system info in registry

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-01 09:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-01 09:43

Reported

2024-10-01 09:46

Platform

win7-20240903-en

Max time kernel

150s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32ce84f74d25f1e71aac67667a2c8d24.exe C:\ProgramData\Dllhost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32ce84f74d25f1e71aac67667a2c8d24.exe C:\ProgramData\Dllhost.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\rundll32 .exe" C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\%tmp%.exe = "C:\\Program Files (x86)\\%tmp%.exe" C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\32ce84f74d25f1e71aac67667a2c8d24 = "\"C:\\ProgramData\\Dllhost.exe\" .." C:\ProgramData\Dllhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\32ce84f74d25f1e71aac67667a2c8d24 = "\"C:\\ProgramData\\Dllhost.exe\" .." C:\ProgramData\Dllhost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2648 set thread context of 3048 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\%tmp%.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
File created C:\Program Files (x86)\%tmp%.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rEG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Dllhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\99796.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rEG.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2012 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe C:\Users\Admin\AppData\LocalfRDeAalfWC.exe
PID 2012 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe C:\Users\Admin\AppData\LocalfRDeAalfWC.exe
PID 2012 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe C:\Users\Admin\AppData\LocalfRDeAalfWC.exe
PID 2012 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe C:\Users\Admin\AppData\LocalfRDeAalfWC.exe
PID 2260 wrote to memory of 2988 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 2988 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 2988 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 2988 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 2924 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2924 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2924 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2924 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2744 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2744 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2744 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2744 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2660 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2660 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2660 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2660 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 1968 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 1968 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 1968 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 1968 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2260 wrote to memory of 2620 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2260 wrote to memory of 2620 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2260 wrote to memory of 2620 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2260 wrote to memory of 2620 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2260 wrote to memory of 2648 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2260 wrote to memory of 2648 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2260 wrote to memory of 2648 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2260 wrote to memory of 2648 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2260 wrote to memory of 1956 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\REG.exe
PID 2260 wrote to memory of 1956 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\REG.exe
PID 2260 wrote to memory of 1956 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\REG.exe
PID 2260 wrote to memory of 1956 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 2180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2988 wrote to memory of 2180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2988 wrote to memory of 2180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2988 wrote to memory of 2180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2260 wrote to memory of 664 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\rEG.exe
PID 2260 wrote to memory of 664 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\rEG.exe
PID 2260 wrote to memory of 664 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\rEG.exe
PID 2260 wrote to memory of 664 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\rEG.exe
PID 2180 wrote to memory of 864 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 864 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 864 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 864 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2648 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2648 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2648 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1812 wrote to memory of 2644 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1812 wrote to memory of 2644 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1812 wrote to memory of 2644 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1812 wrote to memory of 2644 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2648 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2648 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2648 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2648 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2648 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2648 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2648 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2648 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe

"C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe"

C:\Users\Admin\AppData\LocalfRDeAalfWC.exe

"C:\Users\Admin\AppData\LocalfRDeAalfWC.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\java.bat" "

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Default.mp3"

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe

"C:\Users\Admin\AppData\Local\Temp\%tmp%.exe"

C:\Windows\SysWOW64\REG.exe

REG add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\invs.vbs" "C:\Users\Admin\AppData\Roaming\java2.bat

C:\Windows\SysWOW64\rEG.exe

rEG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\java2.bat" "

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ytcrz3tw.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB74.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBB73.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Users\Admin\AppData\Roaming\99796.exe

"C:\Users\Admin\AppData\Roaming\99796.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 412

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 1116

C:\ProgramData\Dllhost.exe

"C:\ProgramData\Dllhost.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\ProgramData\Dllhost.exe" "Dllhost.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.ip.gl.ply.gg udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 8.8.8.8:53 22.ip.gl.ply.gg udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp

Files

memory/2012-0-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

C:\Users\Admin\AppData\LocalfRDeAalfWC.exe

MD5 97ae997014319227a2a3b08033fd81df
SHA1 95b7acd68273a81951ed13890ac6efd746258c42
SHA256 ef41566edb201f685cfedd097970f9b1edb4832c2dabb6309a79f0fb34ee0402
SHA512 103931d8c70e3d9a3f1757b81428b7313c7cda178f3d19ffb4c1ee169e3c642156468ea8d9a4c33802bc0afc0408bc81a6d248789c023565f31b8dd7f45c0fd1

memory/2012-10-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

memory/2260-12-0x0000000074812000-0x0000000074814000-memory.dmp

memory/2260-11-0x0000000000C30000-0x0000000000C70000-memory.dmp

memory/2012-13-0x0000000000790000-0x00000000007A0000-memory.dmp

memory/2260-14-0x0000000074810000-0x0000000074DBB000-memory.dmp

memory/2260-16-0x0000000074810000-0x0000000074DBB000-memory.dmp

memory/2012-17-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

C:\Users\Admin\AppData\Roaming\java.bat

MD5 1896de26a454df8628034ca3e0649905
SHA1 76b98d95a85d043539706b89194c46cf14464abe
SHA256 d85e713743c7e622166fb0f79478de5eabd53d3fe92bd2011ab441bc85ef2208
SHA512 ef69dacd7e717dff05f8a70c5b9a94011f2df3201cc41d5f8cc030f350b069dc090c5b0d3d0bd19098a187977a82d570e1ee153849f609a65889ba789da953d2

\Windows\Temp\System.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe

MD5 6b97067ea717e5c72685a38a15109ecc
SHA1 0ec286ff24307650bcd1881106980d420c646610
SHA256 b62c4ffb4b0622b0dc2fcf684b86863a54636c3af773e71a036c3064075eaf17
SHA512 80613f0da03c01d5d35dedb4617e811a7b2e72032eeedc5ccdb2b8f6c6408ec9f66ad3f9a10f6e357e4ec85c9bb8374c3d64874a5d9699e6def23cdc9748fb7d

C:\Users\Admin\AppData\Roaming\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

C:\Users\Admin\AppData\Roaming\java2.bat

MD5 e8170b6565dfb34d114cfa398ba77296
SHA1 9079335b0ec9a509b7344cb98713fc0b52afa36e
SHA256 76ff7c88cc815c8acd61f835033baf5b92eee085e7316c7230f7c363d1e1974b
SHA512 1b473fe0a68642ff1741f4619f819b040f8d54696d40e74dd9ad692b56729e455bbe54cb76b382bb1fce5e1eae97dd8c99aeb762915f7147bba59d0ba60d004d

C:\Users\Admin\AppData\Local\Temp\Default.mp3

MD5 071720d5f39c31b27711d70b09ef9b3b
SHA1 1fe68bf69c8418454a0d91ad321b99fe9065a1db
SHA256 f8bc97b18db5452e5be748390037c16e606aaf0f61f0896531528d0d5fd08cc7
SHA512 7db5e2039e075916874b071f30aef7c29133182b9bdbc2e3cb9c2296db8a67f2cfd4e49701d85126b6b58d59bd6198f2ce6c5f4eec382209a6576c628d354014

\??\c:\Users\Admin\AppData\Local\Temp\ytcrz3tw.cmdline

MD5 9fc2ce2d58c9877584082a1930e27fbc
SHA1 7723a60b5bde8f87e7af72ad6de738cc12c3b16b
SHA256 dde5d9575bbe8c6d9083048e31600a1349a1a53e7d05df40b71f4ba641205887
SHA512 ef724f1b5b7924a269d308903bd623f0589da4a6d825546b5d572d994ac4e414bc21475b907209655b4167fa9e807bcea98b8e7097f221ebbeb560b63f4df5c7

\??\c:\Users\Admin\AppData\Local\Temp\ytcrz3tw.0.cs

MD5 b63430207638c1a36b9b27002e0da3da
SHA1 54356082f32c71498c4ac5f85f4588e0d1c57ad0
SHA256 fa125ed8e48d596788a8ad5589bc996b918de3fc27008bea888b9e1b5efa2193
SHA512 29ea956fb37628dac43693d5f234698510923d562ab22e53131b1919f788ed5fd3116ed501be79554e47113d795b06f5ad255c7dfee2bb9e021eb0ab14e9b737

C:\Users\Admin\AppData\Local\Temp\RESBB74.tmp

MD5 bcaffd1da5b1352aca0c3fa2b01d5abc
SHA1 a694bc77880138dbc9d0ccbadfb1696bd50fb876
SHA256 0e47d92552dd4ef347fed4486eec8951aa68218c467e4c7800fc984119402635
SHA512 2a54756dd19ee26a7a6d47cfcecc04178bfb7591b51d77c1443542591659dcf61f75e1fa589266e9dfd6c0832f4d7c171b1da98e020b5bb51b614ee30fd0b54b

C:\Users\Admin\AppData\Local\Temp\ytcrz3tw.dll

MD5 d42ba9acb411a99763f94ab5ab4cd2a7
SHA1 0562ac230a8ccc6f9b8d96e30936d552d1f55074
SHA256 13e1d6138a9ea7d7835dcf9837af9dba34a3e24845c7bc68fc217c9b7fb6c4cd
SHA512 bcb56cd9c9266afb997b773afeb3dd59b5aa132ec58112424a28204df8adf5512225143d80d3bc4e1bf50b28dc9fa6b72b04d3d07f56a03b61a4dc43c6cf924c

\??\c:\Users\Admin\AppData\Local\Temp\CSCBB73.tmp

MD5 bc993608fc3311e14e5b0312c40b381d
SHA1 ea46df9af696aadf52bbdc85a08309418dbbc12c
SHA256 ca44d7e9aab41470db1371038acc26b6e4834e88247646e0385f06420838d1a2
SHA512 56dda317f8695ff0f5518d6a02dc1b1301f9e5642383bfd2ca6f948846f086ba0a35dbcb1da70b98f51180ada0d272111416c9b1324844f3ad4f5222cfbb8b75

memory/3048-81-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3048-80-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3048-78-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3048-76-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3048-74-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3048-72-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3048-85-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3048-84-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2260-105-0x0000000074812000-0x0000000074814000-memory.dmp

memory/2260-104-0x0000000000C30000-0x0000000000C70000-memory.dmp

memory/2260-106-0x0000000074810000-0x0000000074DBB000-memory.dmp

memory/2620-107-0x000000013FA80000-0x000000013FB78000-memory.dmp

memory/2620-108-0x000007FEFAF30000-0x000007FEFAF64000-memory.dmp

memory/2620-110-0x000007FEFAC40000-0x000007FEFAC58000-memory.dmp

memory/2620-111-0x000007FEFAC20000-0x000007FEFAC37000-memory.dmp

memory/2620-109-0x000007FEF6300000-0x000007FEF65B6000-memory.dmp

memory/2620-112-0x000007FEFAC00000-0x000007FEFAC11000-memory.dmp

memory/2620-113-0x000007FEFA9B0000-0x000007FEFA9C7000-memory.dmp

memory/2620-114-0x000007FEF7870000-0x000007FEF7881000-memory.dmp

memory/2620-115-0x000007FEF7850000-0x000007FEF786D000-memory.dmp

memory/2620-116-0x000007FEF7830000-0x000007FEF7841000-memory.dmp

memory/2620-117-0x000007FEF60F0000-0x000007FEF62FB000-memory.dmp

memory/2620-118-0x000007FEF6CD0000-0x000007FEF6D11000-memory.dmp

memory/2620-120-0x000007FEF6CA0000-0x000007FEF6CC1000-memory.dmp

memory/2620-121-0x000007FEF6850000-0x000007FEF6868000-memory.dmp

memory/2620-122-0x000007FEF5020000-0x000007FEF5031000-memory.dmp

memory/2620-123-0x000007FEF5000000-0x000007FEF5011000-memory.dmp

memory/2620-119-0x000007FEF5040000-0x000007FEF60F0000-memory.dmp

memory/2620-124-0x000007FEF4FE0000-0x000007FEF4FF1000-memory.dmp

memory/2620-125-0x000007FEF4FC0000-0x000007FEF4FDB000-memory.dmp

memory/2620-126-0x000007FEF4FA0000-0x000007FEF4FB1000-memory.dmp

memory/2620-127-0x000007FEF4F80000-0x000007FEF4F98000-memory.dmp

memory/2620-128-0x000007FEF4F50000-0x000007FEF4F80000-memory.dmp

memory/2620-129-0x000007FEF4EE0000-0x000007FEF4F47000-memory.dmp

memory/2620-130-0x000007FEF4E60000-0x000007FEF4EDC000-memory.dmp

memory/2620-131-0x000007FEF4E40000-0x000007FEF4E51000-memory.dmp

memory/2620-132-0x000007FEF4E20000-0x000007FEF4E38000-memory.dmp

memory/2620-133-0x000007FEF4E00000-0x000007FEF4E11000-memory.dmp

memory/2620-134-0x000007FEF4DA0000-0x000007FEF4DF7000-memory.dmp

memory/2620-135-0x000007FEF4D70000-0x000007FEF4D9F000-memory.dmp

memory/2620-137-0x000007FEF4D30000-0x000007FEF4D41000-memory.dmp

memory/2620-136-0x000007FEF4D50000-0x000007FEF4D63000-memory.dmp

memory/2620-138-0x000007FEF4C60000-0x000007FEF4D25000-memory.dmp

memory/2620-140-0x000007FEF4510000-0x000007FEF4538000-memory.dmp

memory/2620-139-0x000007FEF4540000-0x000007FEF4597000-memory.dmp

memory/2260-142-0x0000000074810000-0x0000000074DBB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-01 09:43

Reported

2024-10-01 09:46

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\64651.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32ce84f74d25f1e71aac67667a2c8d24.exe C:\ProgramData\Dllhost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32ce84f74d25f1e71aac67667a2c8d24.exe C:\ProgramData\Dllhost.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\rundll32 .exe" C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\%tmp%.exe = "C:\\Program Files (x86)\\%tmp%.exe" C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\32ce84f74d25f1e71aac67667a2c8d24 = "\"C:\\ProgramData\\Dllhost.exe\" .." C:\ProgramData\Dllhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\32ce84f74d25f1e71aac67667a2c8d24 = "\"C:\\ProgramData\\Dllhost.exe\" .." C:\ProgramData\Dllhost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3916 set thread context of 4368 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\%tmp%.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
File opened for modification C:\Program Files (x86)\%tmp%.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Dllhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rEG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\64651.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rEG.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A
Token: 33 N/A C:\ProgramData\Dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Dllhost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2560 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe C:\Users\Admin\AppData\LocalfRDeAalfWC.exe
PID 2560 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe C:\Users\Admin\AppData\LocalfRDeAalfWC.exe
PID 2560 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe C:\Users\Admin\AppData\LocalfRDeAalfWC.exe
PID 2104 wrote to memory of 936 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 936 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 936 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 4716 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 4716 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 4716 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 4828 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 4828 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 4828 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 936 wrote to memory of 876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 936 wrote to memory of 876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 936 wrote to memory of 876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2104 wrote to memory of 1096 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 1096 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 1096 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 668 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 668 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 668 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\Temp\System.exe
PID 2104 wrote to memory of 3664 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2104 wrote to memory of 3664 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 876 wrote to memory of 4440 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 876 wrote to memory of 4440 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 876 wrote to memory of 4440 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 3916 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2104 wrote to memory of 3916 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2104 wrote to memory of 3916 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
PID 2104 wrote to memory of 4968 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\REG.exe
PID 2104 wrote to memory of 4968 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\REG.exe
PID 2104 wrote to memory of 4968 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\REG.exe
PID 2104 wrote to memory of 1464 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\rEG.exe
PID 2104 wrote to memory of 1464 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\rEG.exe
PID 2104 wrote to memory of 1464 N/A C:\Users\Admin\AppData\LocalfRDeAalfWC.exe C:\Windows\SysWOW64\rEG.exe
PID 3916 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 3916 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 3916 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4648 wrote to memory of 1468 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4648 wrote to memory of 1468 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4648 wrote to memory of 1468 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3916 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3916 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3916 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3916 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3916 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3916 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3916 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3916 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4368 wrote to memory of 2380 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 4368 wrote to memory of 2380 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 4368 wrote to memory of 2380 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 3916 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Users\Admin\AppData\Roaming\64651.exe
PID 3916 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Users\Admin\AppData\Roaming\64651.exe
PID 3916 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Users\Admin\AppData\Roaming\64651.exe
PID 3916 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 3916 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 3916 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\%tmp%.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 4072 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Roaming\64651.exe C:\ProgramData\Dllhost.exe
PID 4072 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Roaming\64651.exe C:\ProgramData\Dllhost.exe
PID 4072 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Roaming\64651.exe C:\ProgramData\Dllhost.exe
PID 2500 wrote to memory of 1804 N/A C:\ProgramData\Dllhost.exe C:\Windows\SysWOW64\netsh.exe
PID 2500 wrote to memory of 1804 N/A C:\ProgramData\Dllhost.exe C:\Windows\SysWOW64\netsh.exe
PID 2500 wrote to memory of 1804 N/A C:\ProgramData\Dllhost.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe

"C:\Users\Admin\AppData\Local\Temp\307b96d57138b6d00f497d65316874c5c93a734fd4e3d97e8c6beb33afba87ceN.exe"

C:\Users\Admin\AppData\LocalfRDeAalfWC.exe

"C:\Users\Admin\AppData\LocalfRDeAalfWC.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\java.bat" "

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\invs.vbs" "C:\Users\Admin\AppData\Roaming\java2.bat

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Windows\Temp\System.exe

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Default.mp3"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\java2.bat" "

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe

"C:\Users\Admin\AppData\Local\Temp\%tmp%.exe"

C:\Windows\SysWOW64\REG.exe

REG add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\rEG.exe

rEG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iyrycnkv.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9674.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9673.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 788

C:\Users\Admin\AppData\Roaming\64651.exe

"C:\Users\Admin\AppData\Roaming\64651.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 1840

C:\ProgramData\Dllhost.exe

"C:\ProgramData\Dllhost.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\ProgramData\Dllhost.exe" "Dllhost.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 22.ip.gl.ply.gg udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp
US 147.185.221.22:57731 22.ip.gl.ply.gg tcp

Files

memory/2560-0-0x00007FF8928B5000-0x00007FF8928B6000-memory.dmp

memory/2560-1-0x00007FF892600000-0x00007FF892FA1000-memory.dmp

memory/2560-4-0x00007FF892600000-0x00007FF892FA1000-memory.dmp

C:\Users\Admin\AppData\LocalfRDeAalfWC.exe

MD5 97ae997014319227a2a3b08033fd81df
SHA1 95b7acd68273a81951ed13890ac6efd746258c42
SHA256 ef41566edb201f685cfedd097970f9b1edb4832c2dabb6309a79f0fb34ee0402
SHA512 103931d8c70e3d9a3f1757b81428b7313c7cda178f3d19ffb4c1ee169e3c642156468ea8d9a4c33802bc0afc0408bc81a6d248789c023565f31b8dd7f45c0fd1

memory/2104-16-0x0000000074D42000-0x0000000074D43000-memory.dmp

memory/2104-18-0x0000000074D40000-0x00000000752F1000-memory.dmp

memory/2104-19-0x0000000074D40000-0x00000000752F1000-memory.dmp

memory/2560-17-0x00007FF892600000-0x00007FF892FA1000-memory.dmp

memory/2104-20-0x0000000074D40000-0x00000000752F1000-memory.dmp

memory/2104-22-0x0000000074D40000-0x00000000752F1000-memory.dmp

C:\Users\Admin\AppData\Roaming\java.bat

MD5 1896de26a454df8628034ca3e0649905
SHA1 76b98d95a85d043539706b89194c46cf14464abe
SHA256 d85e713743c7e622166fb0f79478de5eabd53d3fe92bd2011ab441bc85ef2208
SHA512 ef69dacd7e717dff05f8a70c5b9a94011f2df3201cc41d5f8cc030f350b069dc090c5b0d3d0bd19098a187977a82d570e1ee153849f609a65889ba789da953d2

C:\Windows\Temp\System.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

C:\Users\Admin\AppData\Roaming\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

C:\Users\Admin\AppData\Local\Temp\Default.mp3

MD5 071720d5f39c31b27711d70b09ef9b3b
SHA1 1fe68bf69c8418454a0d91ad321b99fe9065a1db
SHA256 f8bc97b18db5452e5be748390037c16e606aaf0f61f0896531528d0d5fd08cc7
SHA512 7db5e2039e075916874b071f30aef7c29133182b9bdbc2e3cb9c2296db8a67f2cfd4e49701d85126b6b58d59bd6198f2ce6c5f4eec382209a6576c628d354014

C:\Users\Admin\AppData\Roaming\java2.bat

MD5 e8170b6565dfb34d114cfa398ba77296
SHA1 9079335b0ec9a509b7344cb98713fc0b52afa36e
SHA256 76ff7c88cc815c8acd61f835033baf5b92eee085e7316c7230f7c363d1e1974b
SHA512 1b473fe0a68642ff1741f4619f819b040f8d54696d40e74dd9ad692b56729e455bbe54cb76b382bb1fce5e1eae97dd8c99aeb762915f7147bba59d0ba60d004d

C:\Users\Admin\AppData\Local\Temp\%tmp%.exe

MD5 6b97067ea717e5c72685a38a15109ecc
SHA1 0ec286ff24307650bcd1881106980d420c646610
SHA256 b62c4ffb4b0622b0dc2fcf684b86863a54636c3af773e71a036c3064075eaf17
SHA512 80613f0da03c01d5d35dedb4617e811a7b2e72032eeedc5ccdb2b8f6c6408ec9f66ad3f9a10f6e357e4ec85c9bb8374c3d64874a5d9699e6def23cdc9748fb7d

\??\c:\Users\Admin\AppData\Local\Temp\iyrycnkv.cmdline

MD5 595e3d08434cf988aa8893a1a6b1db14
SHA1 7ec51ce4cc2b61595d211db5b8df27c0d69f9dc9
SHA256 e546764ea515b2fedfe1ba55ed1417676b1fcf2d5cd250f2c9278288acd2112e
SHA512 c4ef0b2dee6dfaac968adc3641b4964dc1f95e59dc1c19d1ade1167252ece51fb655d131b68544db8cce57d834557c1f2a5294fc77ca71fda0a513479b5dcd0c

\??\c:\Users\Admin\AppData\Local\Temp\iyrycnkv.0.cs

MD5 b63430207638c1a36b9b27002e0da3da
SHA1 54356082f32c71498c4ac5f85f4588e0d1c57ad0
SHA256 fa125ed8e48d596788a8ad5589bc996b918de3fc27008bea888b9e1b5efa2193
SHA512 29ea956fb37628dac43693d5f234698510923d562ab22e53131b1919f788ed5fd3116ed501be79554e47113d795b06f5ad255c7dfee2bb9e021eb0ab14e9b737

\??\c:\Users\Admin\AppData\Local\Temp\CSC9673.tmp

MD5 33246cd755f83f60337758d9e0733d92
SHA1 5cb6f79fe4cb9346ff0e7c8b64a570bfaaf440e7
SHA256 eef1c300f9e939b9533b32d4249b8a4c16a3301acad2686bef28a54ce8a0e36c
SHA512 b8035a6a33c5db9f4f1b1a593cbe2f184466f199fb341e565953b1ade5946edf66a78e1acb4f76345915f005ffed4cf62d117e536fcebff3c01a774f139d67a6

C:\Users\Admin\AppData\Local\Temp\RES9674.tmp

MD5 8dc49aa6dfd07b07e1e8c8d494afb319
SHA1 a39ad18455a6b8a3713fdcd19c9dbfaabae7a5b1
SHA256 6afea8f5cb5949aa91d403ec5dea82c7bdf4986de9f2e855cd65a0ecfda232ce
SHA512 79c0b9b16f3c48bab9ef913035cd069193707b9f876d9850dc43e3aec564f3dc0981d5c531b4b6f45a12b464761b818707facf312d98d9ee423d7210e257f6ec

C:\Users\Admin\AppData\Local\Temp\iyrycnkv.dll

MD5 40684d934003ae8ac267577a51689027
SHA1 f6f2bf3e792581fa98df3249462c8783aa482c44
SHA256 de8e9e4ae8b08a6d63db5e16169a3812f8f364c897509e83aa4afbd41371e41b
SHA512 fcc51629f2b43fb7dd6f6ccff4d544c0d5e193a2c52dc4cc052676cb51e2abdd6d2324aea4a4483b30ae1760a18e540894b8cd16295a23d473fa2d0de6c21476

memory/4368-75-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4368-97-0x0000000000410000-0x00000000004D9000-memory.dmp

memory/2104-98-0x0000000074D42000-0x0000000074D43000-memory.dmp

memory/2104-99-0x0000000074D40000-0x00000000752F1000-memory.dmp

memory/3664-110-0x00007FF8A2090000-0x00007FF8A20C4000-memory.dmp

memory/3664-109-0x00007FF77F050000-0x00007FF77F148000-memory.dmp

memory/3664-113-0x00007FF8A2010000-0x00007FF8A2027000-memory.dmp

memory/3664-118-0x00007FF8A1BA0000-0x00007FF8A1BB1000-memory.dmp

memory/3664-117-0x00007FF8A1BC0000-0x00007FF8A1BDD000-memory.dmp

memory/3664-116-0x00007FF8A1E90000-0x00007FF8A1EA1000-memory.dmp

memory/3664-115-0x00007FF8A1EB0000-0x00007FF8A1EC7000-memory.dmp

memory/3664-120-0x00007FF8A12B0000-0x00007FF8A12F1000-memory.dmp

memory/3664-119-0x00007FF8927B0000-0x00007FF8929BB000-memory.dmp

memory/3664-114-0x00007FF8A1ED0000-0x00007FF8A1EE1000-memory.dmp

memory/3664-111-0x00007FF8929C0000-0x00007FF892C76000-memory.dmp

memory/3664-112-0x00007FF8AA350000-0x00007FF8AA368000-memory.dmp

memory/3664-126-0x00007FF89D9D0000-0x00007FF89D9E1000-memory.dmp

memory/3664-125-0x00007FF89E6E0000-0x00007FF89E6F1000-memory.dmp

memory/3664-124-0x00007FF89E700000-0x00007FF89E711000-memory.dmp

memory/3664-123-0x00007FF8A1290000-0x00007FF8A12A8000-memory.dmp

memory/3664-122-0x00007FF8A1700000-0x00007FF8A1721000-memory.dmp

memory/3664-121-0x00007FF891700000-0x00007FF8927B0000-memory.dmp

memory/2104-130-0x0000000074D40000-0x00000000752F1000-memory.dmp

memory/3664-161-0x00007FF891700000-0x00007FF8927B0000-memory.dmp