116780
Process hollowing, C2, persistence
XOR-decoded HTTP URLEntry point in a writable RWX section
SHA-256ef2b8e4f91efd22c0dafa5b1eed04999fcdd2d0192d5963899bdb98cd87201f5
Evidence
⋯5 more rows
0xff000000000000000000000000000000000................
0x1000efdcdf77ccd7dd77a179dd77786add77...w...w.y.wxj.w
0x1010f06bdd77f1eedd773575dd778498df77.k.w...w5u.w...w
0x10208180dd77000000003ce6807c66aa807c...w....<..|f..|
0x1030ad9c807ce0c6807cf1ba807c65a0807c...|...|...|e..|
0x104056ba807c3103917cf11a807cbe19827cV..|1..|...|...|
0x105077b8807c1011817c28ac807cd3ac807cw..|...|(..|...|
0x1060ecb8807c4a11817cc7a0807c399a807c...|J..|...|9..|
0x10709497807c0510907c7b97807ced10907c...|...|{..|...|
0x10808a18917ca19f807c5db2807c23a8807c...|...|]..|#..|
0x10907614817c80a4807cb98c837c771d807cv..|...|...|w..|
0x10a02ae8817c4399807ce62b817c9f0f817c*..|C..|.+.|...|
0x10b0782c817c3d04917cd405917cfd79917cx,.|=..|...|.y.|
0x10c08d2c817cab14817c2b2e837cc4ce807c.,.|...|+..|...|
0x10d0a2ca817c29b5807c57b3807c6a48817c...|)..|W..|jH.|
0x10e05128817c2929817c149b807c819a807cQ(.|)).|...|...|
0x10f0407a937c161e807c0de0807ced09917c@z.|...|...|...|
0x11003797807cf59b807c0f2b817c5334817c7..|...|.+.|S4.|
0x11104003917c5097807ccfc6807ca92c817c@..|P..|...|.,.|
0x11206910817cee1e807c3fdc817c5f48817ci..|...|?..|_H.|
0x113023db817c00000000594b127795d21477#..|....YK.w...w
0x1140d9661277c04812773b4c127726e51277.f.w.H.w;L.w&..w
0x1150c5a513772da61277c24b127750481277...w-..w.K.wPH.w
0x11605ab7147700000000fedad47700000000Z..w.......w....
0x11702cd04f7748d04f77de295377c3fa4f77,.OwH.Ow.)Sw..Ow
0x11800000000000000000ef8800103e920010............>...
0x11906c920010979200100000000000000000l...............
0x11a02ca80010dade00100000000000000000,...............
0x11b000000000000000000000000000000000................
0x11c0085f0010806600109e67001008680010._...f...g...h..
0x11d000000000000000009b6700109b670010.........g...g..
0x11e06c840010000000000000000000000000l...............
0x11f000000000000000000000000000000000................
0x120000000000000000002012001010120010........ .......
0x121054005900500045004c00490042000000T.Y.P.E.L.I.B...
0x122043004c00530049004400000044006500C.L.S.I.D...D.e.
0x12306c00650074006500000000004e006f00l.e.t.e.....N.o.
0x1240520065006d006f007600650000000000R.e.m.o.v.e.....
0x125046006f00720063006500520065006d00F.o.r.c.e.R.e.m.
0x12606f00760065000000560061006c000000o.v.e...V.a.l...
0x127042000000440000005300000000000000B...D...S.......
0x128010592fb62865d11196110000f81e0d0d.Y/.(e..........
0x12906500780070006c006f00720065007200e.x.p.l.o.r.e.r.
0x13a448004b00450059005f00550053004500H.K.E.Y._.U.S.E.
0x13b4520053000000000048004b0045005900R.S.....H.K.E.Y.
0x13c45f004c004f00430041004c005f004d00_.L.O.C.A.L._.M.
0x13d441004300480049004e00450000000000A.C.H.I.N.E.....
0x13e448004b00450059005f00430055005200H.K.E.Y._.C.U.R.
0x13f4520045004e0054005f00550053004500R.E.N.T._.U.S.E.
0x14045200000048004b00450059005f004300R...H.K.E.Y._.C.
0x14144c00410053005300450053005f005200L.A.S.S.E.S._.R.
0x14244f004f005400000048004b0043004300O.O.T...H.K.C.C.
0x14340000000048004b004400440000000000....H.K.D.D.....
0x144448004b00500044000000000048004b00H.K.P.D.....H.K.
0x14545500000048004b004c004d0000000000U...H.K.L.M.....
0x146448004b00430055000000000048004b00H.K.C.U.....H.K.
0x14744300520000000000556e526567697374C.R.....UnRegist
0x14846572547970654c69620000006f006c00erTypeLib...o.l.
0x14946500610075007400330032002e006400e.a.u.t.3.2...d.
0x14a46c006c00000000002e0074006c006200l.l.......t.l.b.
0x14b4000000001204020000000000c0000000................
0x14c400000046d70000002300000018000000...F....#.......
0x14d44a0000008b00000095080000526e6464J...........Rndd
0x14e42431536f7a273c5364673c38533c666e$1Soz'<Sdg<8S<fn
0x14f460512d3f36382431 `Q-?68$1
0x6718170000b8f85e00108bc885c974106a10.....^......t.j.
0x67285068a0e80010e8fd34000083c40cff75Ph......4......u
0x673808ff1590100010eb10837d0c00750a68..........}..u.h
0x6748b8e80010e8671800006a0158c9c20c00.....g...j.X....
0x675833c03905cce800100f95c0c3ff74240c3.9..........t$.
0x6768ff74240cff74240c68b8e80010e86b17.t$..t$.h.....k.
0x67780000c20c006a006a0168b8e80010e8dd.....j.j.h......
0x6788180000c36a006a0168b8e80010e8271a....j.j.h.....'.
0x67980000c333c0c356576a3cbf0e000780e8...3..VWj<......
0x67a84b3900008bf05985f674208d4e04e8f0K9....Y..t .N...
0x67b80100008d4624c7062c5f001050ff1584....F$..,_..P...
0x67c8100010c706185f0010eb0233f685f674......_....3...t
0x67d828ff7424148b4424108946208b06ff74(.t$..D$..F ...t
0x67e8241456ff108bf885ff740e8bcee83200$.V......t....2.
0x67f8000056e8ec380000598bc75f5ec20c00..V..8..Y.._^...
0x6808558becff7510 U...u.
0xe90800000000000000000000000000000000................
0xe91800000000000300000000000001000000................
0xe92880120010000000000000000000000000................
0xe93800000000000000000000000000000000................
0xe94800000000000000000000000000000000................
0xe95800000000000000000000000000000000................
0xe968e3fffffbb1a4a4b8b8a5f2eae4efe7fa................
0xe978a5e8e4e6b1b2b8a4e7e2f8ffa5e3ffe6................
0xe9888b000000000000000000000000000000................
0xe99800000000000000000000000000000000................
0xe9a800000000000000000000000000000000................
0xe9b800000000000000000000000000000000................
0xe9c800000000000000000000000000000000................
0xe9d800000000000000000000000000000000................
0xe9e800000000000000000000000000000000................
0xe9f800000000000000000000000000000000................
0xea0800000000000000000000000000000000................
0xea1800000000000000000000000000000000................
0xea2800000000000000000000000000000000................
0xea3800000000000000000000000000000000................
0xf466d2025769646543686172546f4d756c74..WideCharToMult
0xf4766942797465004b45524e454c33322e64iByte.KERNEL32.d
0xf4866c6c00002700436861724e6578745700ll..'.CharNextW.
0xf4965553455233322e646c6c000063015265USER32.dll..c.Re
0xf4a66744656c6574654b6579570060015265gDeleteKeyW.`.Re
0xf4b6674372656174654b6579457857006501gCreateKeyExW.e.
0xf4c652656744656c65746556616c75655700RegDeleteValueW.
0xf4d65b01526567436c6f73654b6579007301[.RegCloseKey.s.
0xf4e65265674f70656e4b6579457857006801RegOpenKeyExW.h.
0xf4f6526567456e756d4b6579457857008701RegEnumKeyExW...
0xf50652656753657456616c75654578570000RegSetValueExW..
0xf51677015265675175657279496e666f4b65w.RegQueryInfoKe
0xf526795700006b01526567456e756d56616cyW..k.RegEnumVal
0xf5367565570041445641504933322e646c6cueW.ADVAPI32.dll
0xf54600004f00436f5461736b4d656d467265..O.CoTaskMemFre
0xf55665004e00436f5461736b4d656d416c6ce.N.CoTaskMemAll
0xf5666f6300005000436f5461736b4d656d52oc..P.CoTaskMemR
0xf57665616c6c6f6300000d00436f43726561ealloc....CoCrea
0xf5867465496e7374616e636500006f6c6533teInstance..ole3
0xf596322e646c6c004f4c4541555433322e642.dll.OLEAUT32.d
0xf5a66c6c00009f0148656170467265650000ll....HeapFree..
0xf5b6990148656170416c6c6f6300a2014865..HeapAlloc...He
0xf5c661705265416c6c6f6300ca0047657443apReAlloc...GetC
0xf5d66f6d6d616e644c696e65410074014765ommandLineA.t.Ge
0xf5e67456657273696f6e0000bf014c434d61tVersion....LCMa
0xf5f670537472696e67410000c0014c434d61pStringA....LCMa
0xf60670537472696e675700007d0045786974pStringW..}.Exit
0xf61650726f636573730026014765744d6f64Process.&.GetMod
0xf626756c6548616e646c6541000024014765uleHandleA..$.Ge
0xf636744d6f64756c6546696c654e616d6541tModuleFileNameA
0xf64600000901476574456e7669726f6e6d65....GetEnvironme
0xf6566e745661726961626c65410075014765ntVariableA.u.Ge
0xf6667456657273696f6e457841009b014865tVersionExA...He
0xf67661704372656174650000bf0256697274apCreate....Virt
0xf68675616c4672656500bb02566972747561ualFree...Virtua
0xf6966c416c6c6f6300002f0252746c556e77lAlloc../.RtlUnw
0xf6a6696e64009e025465726d696e61746550ind...TerminateP
0xf6b6726f636573730000f700476574437572rocess....GetCur
0xf6c672656e7450726f6365737300a3014865rentProcess...He
0xf6d6617053697a650000fa00476574437572apSize....GetCur
0xf6e672656e7454687265616449640000a502rentThreadId....
0xf6f6546c7353657456616c756500a202546cTlsSetValue...Tl
0xf70673416c6c6f630000a302546c73467265sAlloc....TlsFre
0xf716650071025365744c6173744572726f72e.q.SetLastError
0xf7260000a402546c7347657456616c756500....TlsGetValue.
0xf7366d0253657448 m.SetH