Analysis Overview
SHA256
2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e
Threat Level: Likely malicious
The file 2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e was found to be: Likely malicious.
Malicious Activity Summary
Blocklisted process makes network request
Loads dropped DLL
Executes dropped EXE
Reads user/profile data of web browsers
Deletes itself
ACProtect 1.3x - 1.4x DLL software
Adds Run key to start application
Writes to the Master Boot Record (MBR)
Enumerates connected drives
System Location Discovery: System Language Discovery
Unsigned PE
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Runs ping.exe
Suspicious use of SetWindowsHookEx
Checks processor information in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-01-15 22:25
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-01-15 22:25
Reported
2025-01-15 22:28
Platform
win7-20240903-en
Max time kernel
142s
Max time network
145s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\hotta.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\hotta.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\gltbeuwbu\\zqnxyuax.dll\",DoVirusScan" | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\k: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\p: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\s: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\v: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\x: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\b: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\q: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\t: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\m: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\e: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\g: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\n: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\o: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\r: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\y: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\z: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\a: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\i: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\j: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\l: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\u: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\w: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\h: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PHYSICALDRIVE0 | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\hotta.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
System Network Configuration Discovery: Internet Connection Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe | N/A |
| N/A | N/A | \??\c:\hotta.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe
"C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 -n 2&c:\hotta.exe "C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe"
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
\??\c:\hotta.exe
c:\hotta.exe "C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe"
\??\c:\windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.exe "c:\gltbeuwbu\zqnxyuax.dll",DoVirusScan c:\hotta.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 107.163.241.232:12354 | tcp | |
| US | 107.163.241.232:12354 | tcp | |
| US | 107.163.241.232:12354 | tcp | |
| US | 107.163.241.232:12354 | tcp |
Files
memory/2312-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2312-2-0x0000000000400000-0x0000000000417000-memory.dmp
\??\c:\hotta.exe
| MD5 | 0048df41401a6336a204d481e3a5a118 |
| SHA1 | fc6aaf7d48e6eaee57a0072b034fb07887729991 |
| SHA256 | a4fb17f1a2f31615d133550c71972af8847a2b6d57cf0c2be261d533ccdb14fe |
| SHA512 | 365e80c6d7f996a9f02f88e3ed395665fdb4581d615e1ed11c583bc0eba0869552f29fbd43e07e1962251cf40d020b187bf0d2c2ed50905f6144ea92f078a05a |
memory/2176-4-0x0000000000130000-0x0000000000147000-memory.dmp
memory/2720-7-0x0000000000400000-0x0000000000417000-memory.dmp
\??\c:\gltbeuwbu\zqnxyuax.dll
| MD5 | cbfc06794d16ace6adf42210183fc1b9 |
| SHA1 | 74fc68a2af225b0aca954b3684940747511013c5 |
| SHA256 | b2d21c40c5bfc0f7695945946fa1cdd4eaf2f66a8391ddde6307c5f765fbf525 |
| SHA512 | 181dbe8b63e28a81cb8e0b7240df8745da350e1ab433b157b8b4fd36aa10f0782e807c09563bcffe37cfe64aa1b514b2cc1f179fbcba422d96867179d88e13c9 |
memory/2408-13-0x0000000010000000-0x0000000010032000-memory.dmp
memory/2408-14-0x000000001002C000-0x000000001002D000-memory.dmp
memory/2408-15-0x0000000010000000-0x0000000010032000-memory.dmp
memory/2408-16-0x0000000010000000-0x0000000010032000-memory.dmp
memory/2408-17-0x0000000010000000-0x0000000010032000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2025-01-15 22:25
Reported
2025-01-15 22:30
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\xxsnskq.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\xxsnskq.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\jfemwtlm\\qmuqb.dll\",DoVirusScan" | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\r: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\w: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\z: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\a: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\m: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\n: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\q: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\u: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\x: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\h: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\i: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\l: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\v: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\b: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\j: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\o: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\p: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\s: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\t: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\y: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\e: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\g: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\k: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PHYSICALDRIVE0 | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\xxsnskq.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
System Network Configuration Discovery: Internet Connection Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe | N/A |
| N/A | N/A | \??\c:\xxsnskq.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe
"C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 -n 2&c:\xxsnskq.exe "C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe"
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
\??\c:\xxsnskq.exe
c:\xxsnskq.exe "C:\Users\Admin\AppData\Local\Temp\2fb292210d6b46110d7f67220ee2b61ca5fd44effbbec76adf2a6a39532aea6e.exe"
\??\c:\windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.exe "c:\jfemwtlm\qmuqb.dll",DoVirusScan c:\xxsnskq.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 167.173.78.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 107.163.241.232:12354 | tcp | |
| US | 107.163.241.232:12354 | tcp | |
| US | 107.163.241.232:12354 | tcp | |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | krnaver.com | udp |
| US | 8.8.8.8:53 | 10.173.189.20.in-addr.arpa | udp |
Files
memory/4024-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4024-2-0x0000000000400000-0x0000000000417000-memory.dmp
C:\xxsnskq.exe
| MD5 | 8f184e4b54f4c47fb6a33bfb06cc4486 |
| SHA1 | 5d39f1321cde1e2a8cdaccb8b46e572aa36fcfe0 |
| SHA256 | 153c6cd8f8b1fb4b1533ebd11f9f063f4778017edfef8fb3c1605f1ee44a34d7 |
| SHA512 | ba698462237bea9f63f4bbec1b940ec14e79c19f20ef267fddd63087e267e9ed3e865824954cfdbc7685cff91bbca73ac1385c3eb21376eba4c4bac5aa5ab62a |
memory/1500-7-0x0000000000400000-0x0000000000417000-memory.dmp
\??\c:\jfemwtlm\qmuqb.dll
| MD5 | cbfc06794d16ace6adf42210183fc1b9 |
| SHA1 | 74fc68a2af225b0aca954b3684940747511013c5 |
| SHA256 | b2d21c40c5bfc0f7695945946fa1cdd4eaf2f66a8391ddde6307c5f765fbf525 |
| SHA512 | 181dbe8b63e28a81cb8e0b7240df8745da350e1ab433b157b8b4fd36aa10f0782e807c09563bcffe37cfe64aa1b514b2cc1f179fbcba422d96867179d88e13c9 |
memory/1688-10-0x0000000010000000-0x0000000010032000-memory.dmp
memory/1688-11-0x0000000010001000-0x0000000010021000-memory.dmp
memory/1688-12-0x0000000010000000-0x0000000010032000-memory.dmp
memory/1688-13-0x0000000010001000-0x0000000010021000-memory.dmp