virussign.com_8ddf6e9c5e380e8583bc7a3fd0c9dd70.vir
Multi-stage dropper with injection
Repeating SYSTEM task masquerades in the Microsoft namespaceMulti-stage PE carrier persists a remote-thread injector as SYSTEM
SHA-256da2a2c00b245d943c6e0599aa9f2df3178c3cd92397616b02a4d802dbd84c646
Evidence
⋯8 more rows
0xda50007573657233322e646c6c007368656c.user32.dll.shel
0xda606c33322e646c6c006164766170693332l32.dll.advapi32
0xda702e646c6c0043726561746546696c6541.dll.CreateFileA
0xda8000577269746546696c65005265616446.WriteFile.ReadF
0xda90696c650047657446696c6553697a6500ile.GetFileSize.
0xdaa0436c6f736548616e646c650056697274CloseHandle.Virt
0xdab075616c416c6c6f63005669727475616cualAlloc.Virtual
0xdac0467265650053657446696c65506f696eFree.SetFilePoin
0xdad07465720053657446696c654174747269ter.SetFileAttri
0xdae062757465734100436f707946696c6541butesA.CopyFileA
0xdaf00047657454656d705061746841004465.GetTempPathA.De
0xdb006c65746546696c654100437265617465leteFileA.Create
0xdb1050726f63657373410043726561746554ProcessA.CreateT
0xdb20687265616400536c6565700047657454hread.Sleep.GetT
0xdb3069636b436f756e740049734465627567ickCount.IsDebug
0xdb4067657250726573656e74004f70656e50gerPresent.OpenP
0xdb50726f63657373546f6b656e004c6f6f6brocessToken.Look
⋯4 more rows
0xdba06545784100526567436c6f73654b6579eExA.RegCloseKey
0xdbb0005265674372656174654b6579457841.RegCreateKeyExA
0xdbc00052656744656c65746556616c756541.RegDeleteValueA
0xdbd000437265617465546f6f6c68656c7033.CreateToolhelp3
0xdbe032536e617073686f740050726f6365732Snapshot.Proces
0xdbf073333246697273740050726f63657373s32First.Process
0xdc0033324e657874004f70656e50726f636532Next.OpenProce
0xdc107373005465726d696e61746550726f63ss.TerminateProc
⋯3 more rows
0xdc5062616c4d656d6f727953746174757345balMemoryStatusE
0xdc6078004765744472697665547970654100x.GetDriveTypeA.
0xdc704765744c6f676963616c447269766553GetLogicalDriveS
0xdc807472696e677341004765744d6f64756ctringsA.GetModul
0xdc906546696c654e616d654100476574436feFileNameA.GetCo
0xdca06e736f6c6557696e646f770053686f77nsoleWindow.Show
0xdcb057696e646f77005368656c6c45786563Window.ShellExec
0xdcc0757465410043726561746552656d6f74uteA.CreateRemot
⋯7 more rows
0x1183a73014578697454687265616400008a01s.ExitThread....
0x1184a46696e64436c6f7365008e0146696e64FindClose...Find
0x1185a466972737446696c654100009f014669FirstFileA....Fi
0x1186a6e644e65787446696c654100bd01466fndNextFileA...Fo
0x1187a726d61744d657373616765570000c101rmatMessageW....
⋯13 more rows
⋯3 more rows
0x11d80667075746300a400667265616400a800fputc...fread...
0x11d90667365656b00ab006674656c6c00ac00fseek...ftell...
0x11da06677726974650000b800726577696e64fwrite....rewind
⋯8 more rows
0x11e30000021007372616e640010014e74436c..!.srand...NtCl
0x11e406f73650041014e744372656174655365ose.A.NtCreateSe
0x11e506374696f6e0056014e7444656c617945ction.V.NtDelayE
0x11e607865637574696f6e000066014e744475xecution..f.NtDu
0x11e70706c69636174654f626a65637400ab01plicateObject...
0x11e804e744d6170566965774f665365637469NtMapViewOfSecti
0x11e906f6e000020024e745261697365486172on.. .NtRaiseHar
0x11ea0644572726f7200002d024e7452656c65dError..-.NtRele
0x11eb06173654b657965644576656e7400a202aseKeyedEvent...
⋯7 more rows
⋯7 more rows
0x1389042002a015838365f54554e455f4d4953B.*.X86_TUNE_MIS
0x138a04d5a90000300000004000000ffff0000MZ..............
0x138b0b8000000000000004000000000000000........@.......
0x138c000000000000000000000000000000000................
0x138d0000000000000000000000000f8000000................
⋯15 more rows
⋯7 more rows
0x15388a700004883c428e9f4490000cccccccc...H..(..I......
0x15398cccccccccccccccccccccccccccccccc................
0x153a8488d0d69560000e9d4490000ccccccccH..iV....I......
0x153b8cccccccccccccccccccccccccccccccc................
0x153c84883ec28488d0dcd9f0000e874440000H..(H.......tD..
0x153d8488d0d595600004883c428e9a0490000H..YV..H..(..I..
0x153e8cccccccccccccccccccccccccccccccc................
0x153f84883ec28488d0d2da10000e844440000H..(H..-....DD..
0x154088b0d1aa1000033d285c00f48ca890d0d......3....H....
0x15418a10000488d0d765600004883c428e95d...H..vV..H..(.]
0x15428490000ccccccccccccccccccccccccccI...............
0x154384c8bdc49895b0849896b104989731857L..I.[.I.k.I.s.W
0x15448415641574883ec604533ff498d43d84dAVAWH..`E3.I.C.M
0x15458897bc8498bf9498943c04d8bf04d897b.{.I..I.C.M..M.{
0x15468b84533c945897bb04533c0c744242005.E3.E.{.E3..D$ .
⋯7 more rows
0x154e8f6488b4c2450488d0445020000008944.H.L$PH..E.....D
0x154f8242841b9010000004533c048897c2420$(A.....E3.H.|$
0x15508498bd648ff15766000000f1f4400008bI..H..v`....D...
0x15518d8488b4c245048ff156b6000000f1f44.H.L$PH..k`....D
0x1552800004c8d5c24608bc3498b5b20498b6b..L.\$`..I.[ I.k
0x1553828498b7330498be3415f415e5fc3cccc(I.s0I..A_A^_...
0x15548cccccccccccccccc40565741564883ec........@VWAVH..
0x155583048c7442420feffffff48895c2450480H.D$ ....H.\$PH
0x15568896c2458498bf0488bea488bd94d8bc8.l$XI..H..H..M..
0x155784c8bc2488bd148c7c100000080e8aefeL..H..H.........
0x15588ffff8bf84533f685c07479488d15be64....E3...tyH...d
0x155980000488d4c2468e8381b0000904885db..H.L$h.8....H..
0x155a87505418bc6eb0e4883c8ff48ffc06644u.A....H...H..fD
0x155b839344375f6448bc0488bd3488d4c246894Cu.D..H..H.L$h
0x155c8e88b1e00004c8bce4c8bc5488b542468.....L..L..H.T$h
⋯4 more rows