Hostile ^100% Download

911b276c55e641252b1396a2a442632e3d491ad09329f0536b94103ea90abb68

svchost injection, AV kill, C2

Persistent WinExec payload targets security processesINI-configured URLMon downloader executes payload

SHA-256911b276c55e641252b1396a2a442632e3d491ad09329f0536b94103ea90abb68

URLhttps://tria.ge/api/v0/samples/260926-v7bjtsxv7j/sample

MaleculeO₇(C₆Er₅As₃DyI₃P₄Pr)H₈(Cm₄F₄HfMgOs₁₁Po₅TiU₂)Md₄(Bi₇HePaSi)

Evidence

Runtime Process32First API name 0x9852–0x9a02

⋯7 more rows
0x98c272656e7450726f636573734964009802rentProcessId...
0x98d250726f6365737333324e657874005e03Process32Next.^.
0x98e25465726d696e61746550726f63657373TerminateProcess
0x98f2000086024f70656e50726f6365737300....OpenProcess.
0x9902960250726f6365737333324669727374..Process32First
0x991200004300436f707946696c6541007d01..C.CopyFileA.}.
⋯15 more rows

References the Windows URLMon library 0x9d62–0x9ee2

⋯6 more rows
0x9dc255524c446f776e6c6f6164546f46696cURLDownloadToFil
0x9dd26541000075726c6d6f6e2e646c6c0000eA..urlmon.dll..
0x9de25753325f33322e646c6c00002b004765WS2_32.dll..+.Ge
0x9df27449665461626c6500001c0047657441tIfTable....GetA
⋯15 more rows

Imports the URLMon file-download API 0x9f84–0xa274

⋯7 more rows
0x9ff400000000000000000000000000000000................
0xa004a0490010000000000000000000000000.I..............
0xa014000000000000000000000000bca20010................
0xa024000000002e4800004465736372697074.....H..Descript
0xa034696f6e00534f4654574152455c4d6963ion.SOFTWARE\Mic
0xa044726f736f66745c57696e646f7773204erosoft\Windows N
0xa054545c43757272656e7456657273696f6eT\CurrentVersion
0xa0645c537663686f73740000000053657276\Svchost....Serv
0xa074696365446c6c000053595354454d5c43iceDll..SYSTEM\C
0xa084757272656e74436f6e74726f6c536574urrentControlSet
0xa0945c53657276696365735c25735c506172\Services\%s\Par
0xa0a4616d657465727300252553797374656dameters.%%System
0xa0b4526f6f7425255c53797374656d33325cRoot%%\System32\
0xa0c4737663686f73742e657865202d6b2022svchost.exe -k "
0xa0d42573220057696e537461305c44656661%s".WinSta0\Defa
0xa0e4756c7400437265617465456e7669726fult.CreateEnviro
0xa0f46e6d656e74426c6f636b000075736572nmentBlock..user
⋯6 more rows
0xa164a8c400109cc4001094c4001084c40010................
0xa17478c4001068c4001060c4001058c40010x...h...`...X...
0xa1844cc4001040c4001038c4001030c40010[email protected]...
0xa19428c400101cc4001010c4001004c40010(...............
0xa1a4f8c30010e8c30010e4c30010d4c30010................
0xa1b4c8c30010c0c30010b8c30010a8c30010................
0xa1c4a0c3001094c300108cc300107cc30010............|...
0xa1d474c3001068c3001060c3001050c30010t...h...`...P...
0xa1e448c300103cc300102cc3001020c30010H...<...,... ...
0xa1f418c300100cc3001000c30010f4c20010................
0xa204e8c20010d4c20010c8c20010b8c20010................
0xa214a8c2001098c2001090c2001080c20010................
0xa22474c2001070c2001070c2001000000000t...p...p.......
0xa23400000000000000000000000000000000................
⋯4 more rows

Typosquatted svchost.exe drop path 0xa44c–0xa73c

⋯3 more rows
0xa47c6b4865616c0000005155484c50535643kHeal...QUHLPSVC
0xa48c2e45584500000000c8f0d0c700000000.EXE............
0xa49c5261764d6f6e442e65786500bdadc3f1RavMonD.exe.....
0xa4ac000000004b764d6f6e58502e65786500....KvMonXP.exe.
0xa4bcb0d9b6c8cec0cabf0000000062616964............baid
0xa4cc7553616665547261792e657865000000uSafeTray.exe...
0xa4dcb0d9b6c8c9b1b6be0000000042616964............Baid
0xa4ec7553642e657865005151b5e7c4d4b9dcuSd.exe.QQ......
0xa4fcbcd20000515150435254502e65786500....QQPCRTP.exe.
0xa50cbdf0c9bdb0b2c8abcec0cabf00000000................
0xa51c4b53616665547261792e657865000000KSafeTray.exe...
0xa52cbdf0c9bdb6beb0d4000000006b786574............kxet
0xa53c7261792e65786500333630c9b1b6be00ray.exe.360.....
0xa54c33363073642e657865000000333630b0360sd.exe...360.
0xa55cb2c8abcec0cabf00333630747261792e........360tray.
0xa56c65786500506c7567696e4d6500000000exe.PluginMe....
0xa57c3132372e302e302e3100000053655368127.0.0.1...SeSh
0xa58c7574646f776e50726976696c65676500utdownPrivilege.
0xa59c47726f757000000052656d61726b0000Group...Remark..
⋯3 more rows
0xa5dc25730000200000002531000022253100%s.. ...%1.."%1.
0xa5ec25735c7368656c6c5c6f70656e5c636f%s\shell\open\co
0xa5fc6d6d616e640000002573202573000000mmand...%s %s...
0xa60c4170706c69636174696f6e735c696578Applications\iex
0xa61c706c6f72652e6578655c7368656c6c5cplore.exe\shell\
0xa62c6f70656e5c636f6d6d616e6400000000open\command....
0xa63c6578706c6f7265722e65786500000000explorer.exe....
0xa64c5365446562756750726976696c656765SeDebugPrivilege
0xa65c00000000534f4654574152455c4d6963....SOFTWARE\Mic
0xa66c726f736f66745c57696e646f77735c43rosoft\Windows\C
0xa67c757272656e7456657273696f6e5c5275urrentVersion\Ru
0xa68c6e000000433a5c50726f6772616d2046n...C:\Program F
0xa69c696c65735c436f6d6d6f6e2046696c65iles\Common File
0xa6ac735c736376686f73742e657865000000s\scvhost.exe...
0xa6bc53657474696e670052746c4765744e74Setting.RtlGetNt
0xa6cc56657273696f6e4e756d626572730000VersionNumbers..
0xa6dc6e74646c6c2e646c6c00000025642a25ntdll.dll...%d*%
0xa6ec734d487a000000004841524457415245sMHz....HARDWARE
0xa6fc5c4445534352495054494f4e5c537973\DESCRIPTION\Sys
0xa70c74656d5c43656e7472616c50726f6365tem\CentralProce
0xa71c73736f725c3000007e4d487a00000000ssor\0..~MHz....
0xa72c46007200690065006e0064006c007900F.r.i.e.n.d.l.y.
0xa73c4e0061006d0065000000000047657443N.a.m.e.....GetC

Defender security process images 0xac00–0xaef0

⋯3 more rows
0xac305c52756e646c6c33322e657865000000\Rundll32.exe...
0xac4025735c25732e657865000000ceb4b7a2%s\%s.exe.......
0xac50cfd62000446566656e64657200000000.. .Defender....
0xac604e69735372762e657865000041766173NisSrv.exe..Avas
0xac7074000000bdf0c9bd0000000025730000t...........%s..
⋯13 more rows
0xad50697469616c697a65000000004f6c6533itialize....Ole3
0xad60322e646c6c00000077696e696e65742e2.dll...wininet.
0xad70646c6c0052656744656c65746556616cdll.RegDeleteVal
0xad807565410052656744656c6574654b6579ueA.RegDeleteKey
0xad904100000052656753657456616c756545A...RegSetValueE
0xada0784100005265674372656174654b6579xA..RegCreateKey
0xadb045784100526567436c6f73654b657900ExA.RegCloseKey.
0xadc0526567456e756d4b6579457841000000RegEnumKeyExA...
⋯8 more rows
0xae506f6b656e0000000044656c6574655365oken....DeleteSe
0xae6072766963650000004368616e67655365rvice...ChangeSe
0xae707276696365436f6e6669673241000000rviceConfig2A...
0xae8043726561746553657276696365410000CreateServiceA..
⋯7 more rows