f09012f18568a2c3638a26a1ba8918e69ee89926dcd0f2b8346c42e7f8399b42
AV evasion, C2, persistence, self-replication
Persistent WinExec payload targets security processesSvchost masquerade with Run key persistence
SHA-256f09012f18568a2c3638a26a1ba8918e69ee89926dcd0f2b8346c42e7f8399b42
Evidence
⋯5 more rows
0x92fe808080808080808080808080808080808................
0x92ff808080808080808080808080808080808................
0x9300808080808080808080808080808080808................
0x9301808080808080808080808080808080808................
0x9302808080808080808080808080808080808................
0x9303808080808080808080808080808080808................
0x9304808080808080808080808080808080808................
0x9305808080808080808080909090909090909................
0x9306809090909090909090909090909090909................
0x9307809090909090909090909090909090909................
0x9308809090909090909090909090909090909................
0x9309809090909090909090909090909090909................
0x930a809090909090909090909090909090909................
0x930b809090909090909090909090909090909................
0x930c809090909090909090909090909090909................
0x930d809090909090909090909090909090909................
0x930e809090909090909090909090909090909................
0x930f809090909090909090909090909090909................
0x9310809090909090909090909090909090909................
0x9311809090909090909090909090909090909................
0x9312809090909090909090909090909090909................
0x9313809090909090909090909090909090909................
0x9314809090909090909090909090909090909................
0x9315809090909090909090a0a0a0a0a0a0a0a................
0x931680a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x931780a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x931880a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x931980a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x931a80a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x931b80a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x931c80a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x931d80a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x931e80a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x931f80a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x932080a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x932180a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x932280a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x932380a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x932480a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x932580a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x932680a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x932780a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
0x932880a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a................
⋯18 more rows
0xcd9566e64456e7669726f6e6d656e74537472ndEnvironmentStr
0xcd966696e6773410053014765744472697665ingsA.S.GetDrive
0xcd9765479706541004e014765744469736b46TypeA.N.GetDiskF
0xcd986726565537061636545784100eb014765reeSpaceExA...Ge
0xcd99674566f6c756d65496e666f726d617469tVolumeInformati
0xcd9a66f6e410076014765744c6f676963616conA.v.GetLogical
0xcd9b64472697665537472696e67734100ce00DriveStringsA...
0xcd9c646696e64436c6f7365005c024c6f6361FindClose.\.Loca
0xcd9d66c4672656500dc0046696e644e657874lFree...FindNext
0xcd9e646696c6541005f024c6f63616c526541FileA._.LocalReA
0xcd9f66c6c6f63000058024c6f63616c416c6clloc..X.LocalAll
0xcda066f630000d20046696e64466972737446oc....FindFirstF
0xcda16696c65410000c40252656d6f76654469ileA....RemoveDi
0xcda26726563746f7279410000190353657446rectoryA....SetF
⋯9 more rows
0xcdac6697a6500430147657443757272656e74ize.C.GetCurrent
0xcdad650726f63657373496400980250726f63ProcessId...Proc
0xcdae665737333324e657874005e035465726dess32Next.^.Term
0xcdaf6696e61746550726f6365737300008602inateProcess....
0xcdb064f70656e50726f636573730096025072OpenProcess...Pr
0xcdb166f636573733332466972737400004300ocess32First..C.
0xcdb26436f707946696c6541007d014765744dCopyFileA.}.GetM
⋯3 more rows
0xceb1865537973547261792e65786500000000eSysTray.exe....
0xceb28426974446566656e6465720076737365BitDefender.vsse
0xceb3872762e6578650000d0dcc3a8cec0cabfrv.exe..........
⋯7 more rows
0xcebb8000000006b6e7364747261792e657865....knsdtray.exe
0xcebc8000000004e4f44333200000065677569....NOD32...egui
0xcebd82e65786500000000c2f3bfa7b7c80000.exe............
0xcebe84d63736869656c642e65786500000000Mcshield.exe....
0xcebf8bfa8b0cd000000006176702e65786500........avp.exe.
0xcec08462d53656375726500000000662d7365F-Secure....f-se
⋯7 more rows
⋯3 more rows
0xcecbc6b4865616c0000005155484c50535643kHeal...QUHLPSVC
0xceccc2e45584500000000c8f0d0c700000000.EXE............
0xcecdc5261764d6f6e442e65786500bdadc3f1RavMonD.exe.....
0xcecec000000004b764d6f6e58502e65786500....KvMonXP.exe.
0xcecfcb0d9b6c8cec0cabf0000000062616964............baid
0xced0c7553616665547261792e657865000000uSafeTray.exe...
0xced1cb0d9b6c8c9b1b6be0000000042616964............Baid
0xced2c7553642e657865005151b5e7c4d4b9dcuSd.exe.QQ......
0xced3cbcd20000515150435254502e65786500....QQPCRTP.exe.
0xced4cbdf0c9bdb0b2c8abcec0cabf00000000................
0xced5c4b53616665547261792e657865000000KSafeTray.exe...
0xced6cbdf0c9bdb6beb0d4000000006b786574............kxet
0xced7c7261792e65786500333630c9b1b6be00ray.exe.360.....
0xced8c33363073642e657865000000333630b0360sd.exe...360.
0xced9cb2c8abcec0cabf00333630747261792e........360tray.
0xcedac65786500506c7567696e4d6500000000exe.PluginMe....
0xcedbc3132372e302e302e3100000053655368127.0.0.1...SeSh
0xcedcc7574646f776e50726976696c65676500utdownPrivilege.
0xceddc47726f757000000052656d61726b0000Group...Remark..
⋯3 more rows
0xcee1c2573000025732025730000004170706c%s..%s %s...Appl
0xcee2c69636174696f6e735c696578706c6f72ications\iexplor
0xcee3c652e6578655c7368656c6c5c6f70656ee.exe\shell\open
0xcee4c5c636f6d6d616e64000000006578706c\command....expl
0xcee5c6f7265722e6578650000000053654465orer.exe....SeDe
0xcee6c62756750726976696c65676500000000bugPrivilege....
0xcee7c534f4654574152455c4d6963726f736fSOFTWARE\Microso
0xcee8c66745c57696e646f77735c4375727265ft\Windows\Curre
0xcee9c6e7456657273696f6e5c52756e000000ntVersion\Run...
0xceeac433a5c50726f6772616d2046696c6573C:\Program Files
0xceebc5c436f6d6d6f6e2046696c65735c7363\Common Files\sc
0xceecc76686f73742e65786500000053657474vhost.exe...Sett
0xceedc696e670052746c4765744e7456657273ing.RtlGetNtVers
0xceeec696f6e4e756d6265727300006e74646cionNumbers..ntdl
0xceefc6c2e646c6c00000025642a25734d487al.dll...%d*%sMHz
0xcef0c0000000048415244574152455c444553....HARDWARE\DES
0xcef1c4352495054494f4e5c53797374656d5cCRIPTION\System\
0xcef2c43656e7472616c50726f636573736f72CentralProcessor
0xcef3c5c3000007e4d487a0000000046007200\0..~MHz....F.r.
0xcef4c690065006e0064006c0079004e006100i.e.n.d.l.y.N.a.
⋯3 more rows
⋯3 more rows
0xcf4485c52756e646c6c33322e657865000000\Rundll32.exe...
0xcf45825735c25732e657865000000ceb4b7a2%s\%s.exe.......
0xcf468cfd62000446566656e64657200000000.. .Defender....
0xcf4784e69735372762e657865000041766173NisSrv.exe..Avas
0xcf48874000000bdf0c9bd0000000025730000t...........%s..
⋯13 more rows
0xcf568697469616c697a65000000004f6c6533itialize....Ole3
0xcf578322e646c6c00000077696e696e65742e2.dll...wininet.
0xcf588646c6c0052656744656c65746556616cdll.RegDeleteVal
0xcf5987565410052656744656c6574654b6579ueA.RegDeleteKey
0xcf5a84100000052656753657456616c756545A...RegSetValueE
0xcf5b8784100005265674372656174654b6579xA..RegCreateKey
0xcf5c845784100526567436c6f73654b657900ExA.RegCloseKey.
0xcf5d8526567456e756d4b6579457841000000RegEnumKeyExA...
⋯8 more rows
0xcf6686f6b656e0000000044656c6574655365oken....DeleteSe
0xcf67872766963650000004368616e67655365rvice...ChangeSe
0xcf6887276696365436f6e6669673241000000rviceConfig2A...
0xcf69843726561746553657276696365410000CreateServiceA..
⋯7 more rows