Malware Analysis Report

2025-01-22 14:35

Sample ID 241129-snh4fsslfy
Target 17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
SHA256 17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99
Tags
xred bdaejec aspackv2 backdoor discovery persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99

Threat Level: Known bad

The file 17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe was found to be: Known bad.

Malicious Activity Summary

xred bdaejec aspackv2 backdoor discovery persistence

Xred family

Xred

Detects Bdaejec Backdoor.

Bdaejec family

Bdaejec

ASPack v2.12-2.42

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Checks system information in the registry

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-29 15:16

Signatures

Xred family

xred

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-29 15:16

Reported

2024-11-29 15:18

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe"

Signatures

Bdaejec

backdoor bdaejec

Bdaejec family

bdaejec

Detects Bdaejec Backdoor.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xred

backdoor xred

Xred family

xred

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Windows Journal\Journal.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Windows Mail\WinMail.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Windows\svchost.exe
PID 2552 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Windows\svchost.exe
PID 2552 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Windows\svchost.exe
PID 2552 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Windows\svchost.exe
PID 1864 wrote to memory of 536 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 1864 wrote to memory of 536 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 1864 wrote to memory of 536 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 1864 wrote to memory of 536 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 536 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 536 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 536 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 536 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 872 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe
PID 872 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe
PID 872 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe
PID 872 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe
PID 536 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 536 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 536 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 536 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1536 wrote to memory of 2652 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1536 wrote to memory of 2652 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1536 wrote to memory of 2652 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1536 wrote to memory of 2652 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2820 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe C:\Windows\SysWOW64\cmd.exe
PID 2820 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe C:\Windows\SysWOW64\cmd.exe
PID 2820 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe C:\Windows\SysWOW64\cmd.exe
PID 2820 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

"C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe"

C:\Windows\svchost.exe

"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe"

C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

"C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe"

C:\Windows\svchost.exe

C:\Windows\svchost.exe

C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe"

C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe

C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\63d54657.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 docs.google.com udp
GB 142.250.187.206:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.200.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.200.3:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.83:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 23.192.22.93:80 www.microsoft.com tcp

Files

C:\Windows\svchost.exe

MD5 9e3c13b6556d5636b745d3e466d47467
SHA1 2ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA512 5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

memory/2552-5-0x0000000000400000-0x000000000043A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

MD5 247afae327ca2b801fa29546216b7e2e
SHA1 13063686f6cfce200dbd4ffdad43ecd89008ff60
SHA256 fc13eaec9aa3ce50d860c5e2506aa73b1f62d0b6e12bb90e838932c231c42bf0
SHA512 e70e09edb96ba231be28bfb7be9c77b5c185a1d83ea64af8a95cd79401e254dc75aeee74a196d90653bf33ec0a118e032f23bdd7095762125a3275ac3120241f

memory/536-17-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1864-21-0x0000000000400000-0x000000000040D000-memory.dmp

\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

MD5 778cb3794fe4938a575a75a50dd10de7
SHA1 8b7b2a353ea7e48b6678c515ddd734b1f9c0bf82
SHA256 65d7c9788f85a0d2b8635c53e9167e8f9bdc09cac53c23f658a53ff7a7b176ad
SHA512 ea273310deb32718e44e200dd026aa792806854b839ee709a726bda85c69f1e687d1c5d55f877fb0f5606c8d1d6054b99111a9ad6dac2eb2ff8dae50c099a367

memory/872-35-0x0000000000400000-0x0000000000421000-memory.dmp

memory/536-34-0x0000000003F00000-0x0000000003F21000-memory.dmp

\Users\Admin\AppData\Local\Temp\kBLWbv.exe

MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

memory/872-48-0x0000000000030000-0x0000000000039000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

MD5 15e2192b38b8c6162f477113b8ce027d
SHA1 673074054a49a25e9baf6fe2fc7cf8cfc8ae110a
SHA256 4a20c212912cb30990048b595bb1bd396672200f97518e01cc810d4566bb3a52
SHA512 d2427b1c786c13723697f55377a12be0a9cf097d01fd6ec16ec5777e79cc0a1234d5f82d52705e7a9b4a73815e0ce097d2ee39d90317b9fc776cffb15736065a

memory/2820-56-0x00000000000E0000-0x00000000000E9000-memory.dmp

memory/872-55-0x0000000000030000-0x0000000000039000-memory.dmp

memory/536-66-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/1536-80-0x0000000003FF0000-0x0000000004011000-memory.dmp

memory/2652-82-0x0000000000400000-0x0000000000421000-memory.dmp

memory/1172-83-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CnpX4bJH.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

memory/872-104-0x0000000000400000-0x0000000000421000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

memory/1632-116-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1536-117-0x0000000003FF0000-0x0000000004011000-memory.dmp

memory/1536-120-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/2820-119-0x00000000000E0000-0x00000000000E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\100A1654.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Temp\63d54657.bat

MD5 b79b732a30f99e1c204cef8c903a699c
SHA1 2ab6f5621ab5a96a7e8f7ffe14a49b979e96f681
SHA256 b391cff34c538cb052e0abfb775a0d2df8a1ad2273fe4b05d9c9529fb924c97f
SHA512 903c14dcf65cb9e875e54bf4711a42dca69f2f53cd0cb141ed3fb1178fb256e649606a73f8c0845bc782e2dad520e5b715a8d93e36a13ef37775d778245c4b9d

memory/1536-184-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/872-185-0x0000000000030000-0x0000000000039000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-29 15:16

Reported

2024-11-29 15:18

Platform

win10v2004-20241007-en

Max time kernel

112s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe"

Signatures

Bdaejec

backdoor bdaejec

Bdaejec family

bdaejec

Detects Bdaejec Backdoor.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xred

backdoor xred

Xred family

xred

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Windows\svchost.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\svchost.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2368 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Windows\svchost.exe
PID 2368 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Windows\svchost.exe
PID 2368 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Windows\svchost.exe
PID 2816 wrote to memory of 2496 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 2816 wrote to memory of 2496 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 2816 wrote to memory of 2496 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 2496 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 2496 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 2496 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe
PID 2476 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe
PID 2476 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe
PID 2476 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe
PID 2496 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2496 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2496 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5084 wrote to memory of 2280 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 5084 wrote to memory of 2280 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 5084 wrote to memory of 2280 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2852 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

"C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe"

C:\Windows\svchost.exe

"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe"

C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

"C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe"

C:\Windows\svchost.exe

C:\Windows\svchost.exe

C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe"

C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe

C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\35132197.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
GB 142.250.187.206:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.200.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.200.3:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 73.209.201.84.in-addr.arpa udp

Files

C:\Windows\svchost.exe

MD5 9e3c13b6556d5636b745d3e466d47467
SHA1 2ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA512 5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

memory/2368-3-0x0000000000400000-0x000000000043A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

MD5 247afae327ca2b801fa29546216b7e2e
SHA1 13063686f6cfce200dbd4ffdad43ecd89008ff60
SHA256 fc13eaec9aa3ce50d860c5e2506aa73b1f62d0b6e12bb90e838932c231c42bf0
SHA512 e70e09edb96ba231be28bfb7be9c77b5c185a1d83ea64af8a95cd79401e254dc75aeee74a196d90653bf33ec0a118e032f23bdd7095762125a3275ac3120241f

memory/2816-10-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2496-13-0x0000000002270000-0x0000000002271000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_17656c5bd8d7f835fdcd18a71970c942a738290272cc781638b4332ccb45ca99N.exe

MD5 778cb3794fe4938a575a75a50dd10de7
SHA1 8b7b2a353ea7e48b6678c515ddd734b1f9c0bf82
SHA256 65d7c9788f85a0d2b8635c53e9167e8f9bdc09cac53c23f658a53ff7a7b176ad
SHA512 ea273310deb32718e44e200dd026aa792806854b839ee709a726bda85c69f1e687d1c5d55f877fb0f5606c8d1d6054b99111a9ad6dac2eb2ff8dae50c099a367

memory/2476-46-0x0000000000400000-0x0000000000421000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kBLWbv.exe

MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

memory/2496-121-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/2852-120-0x0000000000C90000-0x0000000000C99000-memory.dmp

memory/2280-163-0x0000000000400000-0x0000000000421000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BHOTC3C\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

C:\Users\Admin\AppData\Local\Temp\6D6E59FE.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

memory/2476-171-0x0000000000400000-0x0000000000421000-memory.dmp

memory/1028-172-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2852-174-0x0000000000C90000-0x0000000000C99000-memory.dmp

memory/5084-175-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/5084-193-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/4224-196-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

memory/4224-198-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

memory/4224-197-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

memory/4224-199-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

memory/4224-200-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

memory/4224-201-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

memory/4224-202-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TPWneBD2.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\TPWneBD2.xlsm

MD5 9bb0526ce870163bb9c9a0395065dbc6
SHA1 62f8a55d83f4e6aa48df445d8151c625783de296
SHA256 7356bedc86d9a69e080329ceb6913c34c89d1f501313e997da1265d22426288a
SHA512 52a2e8f6f6660752506021f3cb69e4a1ba1c2bae45357d7fedbb8c30fd697dd29be3f1e301f9f44fb02fc4e7f9af524bbf34e1f4ceda4967f0c284e94a86f2a5

C:\Users\Admin\AppData\Local\Temp\35132197.bat

MD5 8b2becf231040d90f98730819612a80b
SHA1 46ac2a2524358ba69a51e22fb6122f0754487197
SHA256 1f31b0917f9240ab386f9a8921394569ef23839fa4d9af54bd9bc7bb5c1dd221
SHA512 32009ff7202a9c2cb45eda8fef0ec5f9bac2245c2ecf969c2adc720d2dbc66f377f2a13c909d74775e83fcc4cf5b60d4ac40ef365be6f3abf8c86335ea36a2df

memory/5084-263-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/1028-277-0x0000000000400000-0x000000000040D000-memory.dmp

memory/5084-304-0x0000000000400000-0x00000000004DE000-memory.dmp