Malware Analysis Report

2024-10-16 03:31

Sample ID 241002-vatzxawhpm
Target 01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N
SHA256 01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94
Tags
banload discovery downloader dropper evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94

Threat Level: Known bad

The file 01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion persistence trojan

Banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Executes dropped EXE

Loads dropped DLL

Checks BIOS information in registry

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-02 16:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-02 16:47

Reported

2024-10-02 16:49

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe"

Signatures

Banload

trojan dropper downloader banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\fxnkj.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\fxnkj.exe" C:\ProgramData\fxnkj.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\fxnkj.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC} C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\ = "IntDitherer Class" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32\ = "C:\\Windows\\SysWOW64\\mshtml.dll" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe

"C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe"

C:\ProgramData\fxnkj.exe

"C:\ProgramData\fxnkj.exe"

Network

N/A

Files

memory/2172-0-0x0000000000400000-0x000000000069E000-memory.dmp

memory/2172-1-0x0000000003230000-0x000000000343C000-memory.dmp

memory/2172-8-0x0000000003230000-0x000000000343C000-memory.dmp

memory/2172-11-0x0000000000400000-0x000000000069E000-memory.dmp

memory/2172-13-0x0000000000400000-0x000000000069E000-memory.dmp

memory/2172-12-0x0000000000400000-0x000000000069E000-memory.dmp

memory/2172-14-0x0000000003230000-0x000000000343C000-memory.dmp

memory/2172-15-0x0000000003230000-0x000000000343C000-memory.dmp

\ProgramData\fxnkj.exe

MD5 185fcf13769319736d9783307db804c7
SHA1 38b2cf70afebe2b9f791b958768e922904494743
SHA256 ef0981846d70079887547094e95d170137397ceab0ebf1b46e2f1945e1a5b771
SHA512 e2cc6d3a474f64ee490c6fc4b6b8325e9e588f0a00565334ee91b669ebef536aa657f865f3c3d3d01c70a735c4b0895683573f92c2154cb18eb0eeceb6a668c9

C:\ProgramData\Saaaalamm\Mira.h

MD5 6f69f8db5bfe93af6af2529fb4d168d0
SHA1 633e46ce9b641fac4c09b83fbb470895acf67885
SHA256 64d2a64e120af1965c60964108a5b8b8c4a6a1139db5b07ad990e02a8038e99c
SHA512 a6a899a9f7a448e220476e657e768d56494a01027c0170690faaefce5911c0e6fd916271c84224ffe2fb931ea7d20407ade9f8734a2b6fc076787bec3a504299

memory/2172-32-0x0000000003230000-0x000000000343C000-memory.dmp

memory/2172-35-0x0000000003230000-0x000000000343C000-memory.dmp

memory/2172-34-0x0000000000400000-0x000000000069E000-memory.dmp

memory/2792-66-0x0000000000400000-0x0000000000448000-memory.dmp

memory/2792-154-0x0000000000400000-0x0000000000448000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-02 16:47

Reported

2024-10-02 16:49

Platform

win10v2004-20240802-en

Max time kernel

118s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe"

Signatures

Banload

trojan dropper downloader banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\hwrlo.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\hwrlo.exe" C:\ProgramData\hwrlo.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\hwrlo.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8\VarType = "3" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\9 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2\Key = "URL" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\6 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\Section = "InternetShortcut" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15\VarType = "11" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2\Key = "URL" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\7 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294} C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\13\VarType = "18" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\10 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\11\Key = "Author" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8\Key = "IconIndex" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\9 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\9\VarType = "3" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\10 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\12\Key = "Desc" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\13 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\13\Key = "Comment" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\14\VarType = "66" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\5 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\7\Key = "ShowCommand" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046} C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\11 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\12 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\14\Key = "IDList" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\6\VarType = "18" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\ = "URL Shortcut PropSetStorage Mapping" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\CLSID = "{942bc614-676c-464e-b384-d3202aaa02da}" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\14 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\5\Key = "WorkingDirectory" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\10\Key = "IconFile" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\13 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC} C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15\Key = "Roamed" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2 C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\6\Key = "HotKey" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\7\VarType = "3" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\9\Key = "IconFile" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\Section = "InternetShortcut" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\10\Key = "WhatsNew" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\InitPropertyBag C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\13\Key = "HotKey" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\9\Key = "IconIndex" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E39B48E3-27A2-832E-06B9-4EA889139DCC}\InProcServer32\ = "C:\\Windows\\SysWOW64\\ieframe.dll" C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe

"C:\Users\Admin\AppData\Local\Temp\01a888677b3451748982fca9cfc80d45b5f9ea851312aac42bb68f517ad32c94N.exe"

C:\ProgramData\hwrlo.exe

"C:\ProgramData\hwrlo.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
NL 52.111.243.29:443 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp

Files

memory/3856-0-0x0000000000400000-0x000000000069E000-memory.dmp

memory/3856-2-0x0000000004E00000-0x000000000500C000-memory.dmp

memory/3856-9-0x0000000004E00000-0x000000000500C000-memory.dmp

memory/3856-12-0x0000000000400000-0x000000000069E000-memory.dmp

memory/3856-13-0x0000000000400000-0x000000000069E000-memory.dmp

memory/3856-14-0x0000000000400000-0x000000000069E000-memory.dmp

memory/3856-15-0x0000000004E00000-0x000000000500C000-memory.dmp

memory/3856-16-0x0000000004E00000-0x000000000500C000-memory.dmp

memory/3856-17-0x0000000004E00000-0x000000000500C000-memory.dmp

C:\ProgramData\hwrlo.exe

MD5 185fcf13769319736d9783307db804c7
SHA1 38b2cf70afebe2b9f791b958768e922904494743
SHA256 ef0981846d70079887547094e95d170137397ceab0ebf1b46e2f1945e1a5b771
SHA512 e2cc6d3a474f64ee490c6fc4b6b8325e9e588f0a00565334ee91b669ebef536aa657f865f3c3d3d01c70a735c4b0895683573f92c2154cb18eb0eeceb6a668c9

C:\ProgramData\Saaaalamm\Mira.h

MD5 24859ed13ca69d29dd5d2b9bf664db03
SHA1 23601bfac7e0563832f24f61a3fec531aaa254c5
SHA256 bae0c12dd74a5621b2d27ac4c3082c964f70e719da5cc2d7cf57e417a7bda0cc
SHA512 b8f0b45970334ee89887e5dfeab2b39d59d078f36d6cf4c01c236f2d3b1a9586f5ac76d4e31d28c410e7b3422ba95fc97f5e42f7093ee7dc5a2d94f3f4216b23

memory/3856-30-0x0000000000400000-0x000000000069E000-memory.dmp

memory/3856-31-0x0000000004E00000-0x000000000500C000-memory.dmp

C:\ProgramData\Saaaalamm\Mira.h

MD5 6f69f8db5bfe93af6af2529fb4d168d0
SHA1 633e46ce9b641fac4c09b83fbb470895acf67885
SHA256 64d2a64e120af1965c60964108a5b8b8c4a6a1139db5b07ad990e02a8038e99c
SHA512 a6a899a9f7a448e220476e657e768d56494a01027c0170690faaefce5911c0e6fd916271c84224ffe2fb931ea7d20407ade9f8734a2b6fc076787bec3a504299

memory/3856-25-0x0000000004E00000-0x000000000500C000-memory.dmp

C:\DDF.sys .exe

MD5 dc07ff100ce9c8b3239f5a485b559892
SHA1 2b985c547dc6656b2776dc541284ee9094de4ddd
SHA256 93e4083b29e777f3cc9f993134184df270805a482ef92e2ca0bceba5613f80f4
SHA512 7125ebe9dd2500f500086a55e487fe2d302d3e5eed92a86e9321a0bd38e6f89e733c0b40f04519ffb9054ceba1aa8452c7051962f5bfa10c321dc83a37717ae1

memory/488-54-0x0000000000400000-0x0000000000448000-memory.dmp

memory/488-122-0x0000000000400000-0x0000000000448000-memory.dmp