Malware Analysis Report

2025-03-15 04:22

Sample ID 241025-3anrwstlcr
Target 290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N
SHA256 290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895
Tags
bootkit discovery persistence spyware stealer upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895

Threat Level: Shows suspicious behavior

The file 290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N was found to be: Shows suspicious behavior.

Malicious Activity Summary

bootkit discovery persistence spyware stealer upx

ACProtect 1.3x - 1.4x DLL software

Writes to the Master Boot Record (MBR)

Enumerates connected drives

UPX packed file

Loads dropped DLL

Executes dropped EXE

Unsigned PE

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Reads user/profile data of web browsers

NSIS installer

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-25 23:18

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win7-20241023-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Reads user/profile data of web browsers

spyware stealer

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3068 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 3068 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 3068 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 3068 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2500 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 596 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 596 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 596 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 596 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1840 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1840 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1840 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1840 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1204 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1204 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1204 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1204 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2500 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2000 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2000 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2000 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2000 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe

"C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe"

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '761650' m 'FRG_Website' t '0' l 'Default'"

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.freeridegames.com udp
US 104.19.182.100:80 www.freeridegames.com tcp
US 8.8.8.8:53 img.exent.com udp
US 104.16.148.233:80 img.exent.com tcp

Files

\Users\Admin\AppData\Local\Temp\nsdBA1C.tmp\System.dll

MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

\Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
SHA1 add92b031eb36b26335763780df88bca58636ed7
SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

MD5 2db35d715864b8846f21dc95756171e0
SHA1 ed9030449256bd21e4f041961fb27bbbeddd7fff
SHA256 854bb62475a4b700a7ec49651610d050f1651491d0148c4bd4928b18bdc0436b
SHA512 65b62a0450a60f736af6ac42d6bec252160feac0681cc6319cbd32e76d631a4ea6d206dd62cee5cc00dd22e3de8dbf042024caa22d4288f8b932276f7b93898f

memory/2500-45-0x0000000000400000-0x0000000000564000-memory.dmp

memory/3068-43-0x00000000035D0000-0x0000000003734000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

MD5 5cf0fba9e8775382233c8e63e52c838a
SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

memory/2500-48-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2500-52-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

MD5 51d301714c7361192d6305f6c46d90d1
SHA1 f546aac6dfab1187228df393e0db2c21e4fee1d0
SHA256 c9245047b86f8359a7f313434b85af481008e8cdf9579fd55aff8b8fbfb5ebcb
SHA512 9b6149c9c099f9cea3d574723d9ff6678d4f91ae7408349738a999d4986ce3cb7b4886f2972f6f1d3b27f7f7453a764f05c50d383f7054234b4ae55437d369b6

memory/2776-64-0x0000000000240000-0x0000000000242000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 4174cb800274e3c271f7e53ae1b9ae35
SHA1 6ac0ca77eef3b68c8db3349f1ceb0c8083450642
SHA256 d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e
SHA512 c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

memory/1220-74-0x00000000003D0000-0x00000000003D2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 ac601698b8129c759d25c885c005eafb
SHA1 ac17456faaccd5cd05e9311c3ca80de271be05bb
SHA256 3dec943fe99e8af26be86bd68ab74383f044f53a7037b06c7d8c336f984143c3
SHA512 ef6b9f10d3878894e826a335cc021f8e705a344c5f4458bc13e0c0a7a369cad89e8b75cc38da852aa8644eea5a092a613fd7817a4f0330ded92e393ac42725c0

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 29d168c06081c63a57bd0de1824dcdc9
SHA1 d9c7ee529581869264776377ff5019e2f7294b69
SHA256 cfdbe86cfd4e61922b6d21549ee0ceaac5686a1e02dc429a621b569b4ff57d4d
SHA512 fdfdba3d230c47629aad5b277068032342e41894c6ec181f30cd6a70da5c11f023c526ff312c477f37046e4f87177f27156a260c7ef6762562baccfcb3eac769

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0LL7CB6P.txt

MD5 b97ae36299d6e1bc4d2a43c492a92677
SHA1 8054abdedcb6ba608d564d581a4998c555dc97e9
SHA256 4b99e122ea86b455fa23f56d437192095f8702182c7174dd32b356be4adc66b6
SHA512 3b490f32b43de243073a955f37fa75dbe470f82b03763ca0236a218d2765fa357b3f5af2b93ce86b41fa0843a186b3466d43ffa62bb0cb93f851987b6857594a

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 7364db3801b4d15cf109d74c6116020b
SHA1 9d379d0aac2b9e2f668e930d74aabd8dd9ec7cf8
SHA256 bd0357112e70e97f13182147f07c50d2543d62613655faeb7b1a129d03bf11fc
SHA512 ae1802e0513ba994b9fde09ea31d87646ce50bebcea4aac0e64b2a2e619541a3fbea5457ae1f7c955d46ab3917e6f5c318704507db78ff405817af1dc58916a3

memory/3068-152-0x00000000035D0000-0x0000000003734000-memory.dmp

memory/2500-153-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-154-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2500-155-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-157-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-159-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-161-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-163-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-165-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-167-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-169-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-171-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-173-0x0000000000400000-0x0000000000564000-memory.dmp

memory/2500-175-0x0000000000400000-0x0000000000564000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win10v2004-20241007-en

Max time kernel

112s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A

Enumerates physical storage devices

Reads user/profile data of web browsers

spyware stealer

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 624 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 624 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 624 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 4780 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2568 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2568 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2568 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3600 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3600 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3600 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3112 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3112 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3112 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3916 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3916 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3916 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 112 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 112 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 112 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3504 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3504 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3504 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 332 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 332 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 332 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2308 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2308 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2308 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4168 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4168 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4168 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4780 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe

"C:\Users\Admin\AppData\Local\Temp\290d04e01c7d24d4255dc396e6d01198196e97406dc5271840912f75388f7895N.exe"

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '761650' m 'FRG_Website' t '0' l 'Default'"

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

ER

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 www.freeridegames.com udp
US 104.19.183.100:80 www.freeridegames.com tcp
US 8.8.8.8:53 100.183.19.104.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nslAE52.tmp\System.dll

MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

C:\Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
SHA1 add92b031eb36b26335763780df88bca58636ed7
SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

MD5 2db35d715864b8846f21dc95756171e0
SHA1 ed9030449256bd21e4f041961fb27bbbeddd7fff
SHA256 854bb62475a4b700a7ec49651610d050f1651491d0148c4bd4928b18bdc0436b
SHA512 65b62a0450a60f736af6ac42d6bec252160feac0681cc6319cbd32e76d631a4ea6d206dd62cee5cc00dd22e3de8dbf042024caa22d4288f8b932276f7b93898f

memory/4780-44-0x0000000000400000-0x0000000000564000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

MD5 5cf0fba9e8775382233c8e63e52c838a
SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

memory/4780-47-0x0000000010000000-0x000000001009F000-memory.dmp

memory/4780-50-0x0000000010000000-0x000000001009F000-memory.dmp

memory/4780-52-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

MD5 51d301714c7361192d6305f6c46d90d1
SHA1 f546aac6dfab1187228df393e0db2c21e4fee1d0
SHA256 c9245047b86f8359a7f313434b85af481008e8cdf9579fd55aff8b8fbfb5ebcb
SHA512 9b6149c9c099f9cea3d574723d9ff6678d4f91ae7408349738a999d4986ce3cb7b4886f2972f6f1d3b27f7f7453a764f05c50d383f7054234b4ae55437d369b6

memory/924-62-0x0000000000420000-0x000000000045A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

MD5 4174cb800274e3c271f7e53ae1b9ae35
SHA1 6ac0ca77eef3b68c8db3349f1ceb0c8083450642
SHA256 d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e
SHA512 c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

memory/1144-73-0x0000000000E70000-0x0000000000EAA000-memory.dmp

memory/3860-86-0x0000000000360000-0x000000000039A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

MD5 694f39eac824ea214e34aa65468e57dd
SHA1 e448553a0b0d9975c4ce809767e9f9cae0e7a424
SHA256 c40c80995e262d8144941d4af197449ab43ac8f67e81adb4203c5ece97c56ba9
SHA512 652df347ef9afd5c21ff9b7611540b6fbb38498725b08b506dbee3a0897cf81c0bf4cfa6416c5e84e62cef425b97e76d7bf09835bae125cd2ad49dbd986a3f4c

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 e82975d4deb4f934f08c9ce1fd7b8554
SHA1 ee55083cf546899c40c3eba4a38d84a3a1eb19a9
SHA256 28cda29ed1732f54a10cbee0627090f84a4ac6073c296a67a04010ea57e0ff4c
SHA512 caa6d74353b5285aa595e18cc1c3741dd8d8b5884204cf2697448e54eb45ded4ab0a8864fc5e60374a566742308b9625f26d899048cd59ad3287538724c70839

memory/3288-106-0x0000000000860000-0x000000000089A000-memory.dmp

memory/1148-116-0x00000000005F0000-0x000000000062A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Temp\ietemp1.dat

MD5 2e980caabfb573b04e34f76a7ca5fa43
SHA1 39607248ec6965714ed5906d34498ee4eee47fc8
SHA256 097f207f4e4c62bd6f4ae066abdfb185ab208a2d0683c81afa44d19155781e08
SHA512 6a65f47c8301112febf1ec01d1efd1bf5e707fb235e79cfcac17f4e7be7d41d15751a460aa4605086f721af95ba0f366a5b979fdcdfd5de597b91320f1cdd22c

memory/3680-122-0x00000000006E0000-0x000000000071A000-memory.dmp

memory/2068-139-0x0000000000100000-0x000000000013A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Temp\ietemp1.dat

MD5 b702a7a356a9d6bd9e4bf340446bc079
SHA1 faf62dbeee610f06e39ceaf639aff22ac11ea25e
SHA256 6a99eb79471f43afe6b6402b69ea01c4c3f311d54b931561b71cb770c79be68d
SHA512 f9a60fad43d1011a4dd2fbaf28f62b9dc01fb1015a2086d01581ee1413a13a545b506cfa3222ba8348574d8fb15cce1f265ef1ec438c9940142a29c931610da0

memory/4244-148-0x00000000001E0000-0x000000000021A000-memory.dmp

memory/4780-176-0x0000000000400000-0x0000000000564000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win10v2004-20241007-en

Max time kernel

110s

Max time network

115s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4392 wrote to memory of 2732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4392 wrote to memory of 2732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4392 wrote to memory of 2732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2732 -ip 2732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 101.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/2732-0-0x0000000075610000-0x0000000075619000-memory.dmp

memory/2732-2-0x0000000075610000-0x0000000075619000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win10v2004-20241007-en

Max time kernel

115s

Max time network

116s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3988 wrote to memory of 968 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3988 wrote to memory of 968 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3988 wrote to memory of 968 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 968 -ip 968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win7-20240903-en

Max time kernel

14s

Max time network

18s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 220

Network

N/A

Files

memory/2400-2-0x0000000074C80000-0x0000000074C89000-memory.dmp

memory/2400-1-0x0000000074C70000-0x0000000074C79000-memory.dmp

memory/2400-0-0x0000000074C80000-0x0000000074C89000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win7-20240903-en

Max time kernel

14s

Max time network

18s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 300 -s 232

Network

N/A

Files

memory/300-0-0x0000000010000000-0x0000000010063000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win10v2004-20241007-en

Max time kernel

111s

Max time network

115s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1268 wrote to memory of 1400 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1268 wrote to memory of 1400 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1268 wrote to memory of 1400 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 99.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 210.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/1400-0-0x0000000010000000-0x0000000010063000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win7-20240708-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Network

N/A

Files

memory/1948-0-0x0000000000400000-0x0000000000564000-memory.dmp

memory/1948-3-0x0000000000400000-0x0000000000564000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win10v2004-20241007-en

Max time kernel

112s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

memory/4792-0-0x0000000000400000-0x0000000000564000-memory.dmp

memory/4792-2-0x0000000000400000-0x0000000000564000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win7-20241010-en

Max time kernel

13s

Max time network

19s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 228

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win10v2004-20241007-en

Max time kernel

115s

Max time network

116s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3160 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3160 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3160 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2324 -ip 2324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 102.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 110.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 226.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win7-20240729-en

Max time kernel

15s

Max time network

17s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2552 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2552 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2552 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2552 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2552 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2552 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win10v2004-20241007-en

Max time kernel

114s

Max time network

117s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1920 wrote to memory of 2212 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1920 wrote to memory of 2212 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1920 wrote to memory of 2212 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2212 -ip 2212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 226.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win7-20241010-en

Max time kernel

64s

Max time network

19s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2772 wrote to memory of 2808 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2772 wrote to memory of 2808 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2772 wrote to memory of 2808 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2772 wrote to memory of 2808 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2772 wrote to memory of 2808 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2772 wrote to memory of 2808 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2772 wrote to memory of 2808 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Network

N/A

Files

memory/2808-0-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2808-2-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2808-1-0x0000000010000000-0x000000001009F000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win7-20240903-en

Max time kernel

119s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 224

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win7-20240903-en

Max time kernel

117s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win10v2004-20241007-en

Max time kernel

115s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-10-25 23:18

Reported

2024-10-25 23:20

Platform

win10v2004-20241007-en

Max time kernel

112s

Max time network

113s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1868 wrote to memory of 1144 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1868 wrote to memory of 1144 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1868 wrote to memory of 1144 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/1144-0-0x0000000010000000-0x000000001009F000-memory.dmp