Trojan.BankBot.3488

Technical Information

Triggers a user-defined sigma rule:

a1a144b7-5c9b-4853-a559-2172be8d4a03
c09dad97-1c78-4f71-b127-7edb2b8e491a
f4bbd493-b796-416e-bbf2-121235348529
17769c90-230e-488b-a463-e05c08e9d48f
81bcb81b-5b1f-474b-b373-52c871aaa7b1
ce72ef99-22f1-43d4-8695-419dcb5d9330
0cfc460b1b267723fd6cb45c14ccc929d9ce2e1ff5952ffe19ca705fed6d4bbe
85ff530b-261d-48c6-a441-facaa2e81e48
02d1d718-dd13-41af-989d-ea85c7fab93f
f239b326-2f41-4d6b-9dfa-c846a60ef505
5e42535532a60f0f232336336ab4379d1e11719d08d9113447e556537fb7798d
fa5b1358-b040-4403-9868-15f7d9ab6329
37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1
26481afe-db26-4228-b264-25a29fe6efc7

To ensure autorun and distribution

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\NUXCTTKD] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\NUXCTTKD] 'ImagePath' = '%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe'
[HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\sejwafmrhmsx.sys'

Creates the following services

'NUXCTTKD' %ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe
'WinRing0_1_2_0' %WINDIR%\TEMP\sejwafmrhmsx.sys

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Event Logging

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Injects code into

the following system processes:

<SYSTEM32>\dialer.exe
<SYSTEM32>\winlogon.exe
<SYSTEM32>\lsass.exe
<SYSTEM32>\svchost.exe
<SYSTEM32>\dwm.exe
<SYSTEM32>\wudfhost.exe
<SYSTEM32>\spoolsv.exe
<SYSTEM32>\sihost.exe
<SYSTEM32>\taskhostw.exe
%WINDIR%\explorer.exe
<SYSTEM32>\runtimebroker.exe
<SYSTEM32>\dllhost.exe
<SYSTEM32>\securityhealthsystray.exe
<SYSTEM32>\oobe\useroobebroker.exe
<SYSTEM32>\wbem\wmiprvse.exe
<SYSTEM32>\applicationframehost.exe
<SYSTEM32>\conhost.exe
<SYSTEM32>\powercfg.exe
<SYSTEM32>\sc.exe
<SYSTEM32>\windowspowershell\v1.0\powershell.exe
<SYSTEM32>\cmd.exe
<SYSTEM32>\wusa.exe

the following user processes:

iexplore.exe
firefox.exe
decrypted_temp.exe
cryptor.dll
1.exe
sletikpcfccn.exe

Hooks functions

in browsers

firefox.exe process, advapi32.dll module
iexplore.exe process, advapi32.dll module

Patches code

in dll

dialer.exe process, KERNEL32.dll module
runtimebroker.exe process, ADVAPI32.dll module
decrypted_temp.exe process, SECHOST.dll module
decrypted_temp.exe process, ADVAPI32.dll module
svchost.exe process, SECHOST.dll module
svchost.exe process, ADVAPI32.dll module
cryptor.dll process, SECHOST.dll module
cryptor.dll process, ADVAPI32.dll module
powercfg.exe process, SECHOST.dll module
powercfg.exe process, ADVAPI32.dll module
sc.exe process, SECHOST.dll module
sc.exe process, ADVAPI32.dll module
powershell.exe process, SECHOST.dll module
powershell.exe process, ADVAPI32.dll module
cmd.exe process, SECHOST.dll module
cmd.exe process, ADVAPI32.dll module
wusa.exe process, SECHOST.dll module
wusa.exe process, ADVAPI32.dll module

in NTDLL dll

dialer.exe process, ntdll.dll module
decrypted_temp.exe process, ntdll.dll module
svchost.exe process, ntdll.dll module
cryptor.dll process, ntdll.dll module
powercfg.exe process, ntdll.dll module
sc.exe process, ntdll.dll module
powershell.exe process, ntdll.dll module
cmd.exe process, ntdll.dll module
wusa.exe process, ntdll.dll module

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\dialer.exe

Modifies file system

Creates the following files

%TEMP%\_mei51162\crypto\cipher\_arc4.pyd
%TEMP%\_mei51162\crypto\cipher\_salsa20.pyd
%TEMP%\_mei51162\crypto\cipher\_chacha20.pyd
%TEMP%\_mei51162\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_des.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei51162\crypto\hash\_blake2b.pyd
%TEMP%\_mei51162\crypto\hash\_blake2s.pyd
%TEMP%\_mei51162\crypto\hash\_md2.pyd
%TEMP%\_mei51162\crypto\hash\_md4.pyd
%TEMP%\_mei51162\crypto\hash\_md5.pyd
%TEMP%\_mei51162\crypto\hash\_ripemd160.pyd
%TEMP%\_mei51162\crypto\hash\_sha1.pyd
%TEMP%\_mei51162\crypto\hash\_sha224.pyd
%TEMP%\_mei51162\crypto\hash\_sha256.pyd
%TEMP%\_mei51162\crypto\hash\_sha384.pyd
%TEMP%\_mei51162\crypto\hash\_sha512.pyd
%TEMP%\_mei51162\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei51162\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei51162\crypto\hash\_keccak.pyd
%TEMP%\_mei51162\crypto\hash\_poly1305.pyd
%TEMP%\_mei51162\crypto\math\_modexp.pyd
%TEMP%\_mei51162\crypto\protocol\_scrypt.pyd
%TEMP%\_mei51162\crypto\publickey\_curve25519.pyd
%TEMP%\_mei51162\crypto\publickey\_curve448.pyd
%TEMP%\_mei51162\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei51162\crypto\publickey\_ed25519.pyd
%TEMP%\_mei51162\crypto\publickey\_ed448.pyd
%TEMP%\_mei51162\crypto\util\_cpuid_c.pyd
%TEMP%\_mei51162\crypto\util\_strxor.pyd
%TEMP%\_mei51162\vcruntime140.dll
%TEMP%\_mei51162\vcruntime140_1.dll
%TEMP%\_mei51162\_asyncio.pyd
%TEMP%\_mei51162\_bz2.pyd
%TEMP%\_mei51162\_cffi_backend.cp314-win_amd64.pyd
%TEMP%\_mei51162\_ctypes.pyd
%TEMP%\_mei51162\_decimal.pyd
%TEMP%\_mei51162\_hashlib.pyd
%TEMP%\_mei51162\_lzma.pyd
%TEMP%\_mei51162\_multiprocessing.pyd
%TEMP%\_mei51162\_overlapped.pyd
%TEMP%\_mei51162\_queue.pyd
%TEMP%\_mei51162\_socket.pyd
%TEMP%\_mei51162\_ssl.pyd
%TEMP%\_mei51162\_wmi.pyd
%TEMP%\_mei51162\_zstd.pyd
%TEMP%\_mei51162\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei51162\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei51162\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei51162\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei51162\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei51162\base_library.zip
%TEMP%\_mei51162\libcrypto-3.dll
%TEMP%\_mei51162\libffi-8.dll
%TEMP%\_mei51162\libssl-3.dll
%TEMP%\_mei51162\pyexpat.pyd
%TEMP%\_mei51162\python314.dll
%TEMP%\_mei51162\select.pyd
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
%TEMP%\_mei51162\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei51162\ucrtbase.dll
%TEMP%\_mei51162\unicodedata.pyd
<Current directory>\decrypted_temp.exe
%TEMP%\_mei16482\vcruntime140.dll
%TEMP%\_mei16482\_bz2.pyd
%TEMP%\_mei16482\_ctypes.pyd
%TEMP%\_mei16482\_decimal.pyd
%TEMP%\_mei16482\_hashlib.pyd
%TEMP%\_mei16482\_lzma.pyd
%TEMP%\_mei16482\_socket.pyd
%TEMP%\_mei16482\_ssl.pyd
%TEMP%\_mei16482\_zstd.pyd
%TEMP%\_mei16482\base_library.zip
%TEMP%\_mei16482\libcrypto-3.dll
%TEMP%\_mei16482\libffi-8.dll
%TEMP%\_mei16482\libssl-3.dll
%TEMP%\_mei16482\python314.dll
%TEMP%\_mei16482\select.pyd
%TEMP%\_mei16482\unicodedata.pyd
%TEMP%\gtgi5hld
%TEMP%\neet_marker.txt
%TEMP%\tmpq6edpd20\input.exe
<Current directory>\bluestacks.exe
%TEMP%\tmpe6ymv3be\cryptor.dll
%TEMP%\_mei23562\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
%TEMP%\_mei23562\vcruntime140.dll
%TEMP%\_mei23562\vcruntime140_1.dll
%TEMP%\_mei23562\_asyncio.pyd
%TEMP%\_mei23562\_bz2.pyd
%TEMP%\_mei23562\_cffi_backend.cp313-win_amd64.pyd
%TEMP%\_mei23562\_ctypes.pyd
%TEMP%\_mei23562\_decimal.pyd
%TEMP%\_mei23562\_hashlib.pyd
%TEMP%\_mei23562\_lzma.pyd
%TEMP%\_mei23562\_multiprocessing.pyd
%TEMP%\_mei23562\_overlapped.pyd
%TEMP%\_mei23562\_queue.pyd
%TEMP%\_mei23562\_socket.pyd
%TEMP%\_mei23562\_sqlite3.pyd
%TEMP%\_mei23562\_ssl.pyd
%TEMP%\_mei23562\_wmi.pyd
%TEMP%\_mei23562\base_library.zip
%TEMP%\_mei23562\certifi\cacert.pem
%TEMP%\_mei23562\charset_normalizer\cd.cp313-win_amd64.pyd
%TEMP%\_mei23562\charset_normalizer\md.cp313-win_amd64.pyd
%TEMP%\_mei23562\cryptography-48.0.0.dist-info\installer
%TEMP%\_mei23562\cryptography-48.0.0.dist-info\metadata
%TEMP%\_mei23562\cryptography-48.0.0.dist-info\record
%TEMP%\_mei23562\cryptography-48.0.0.dist-info\wheel
%TEMP%\_mei23562\cryptography-48.0.0.dist-info\licenses\license
%TEMP%\_mei23562\cryptography-48.0.0.dist-info\licenses\license.apache
%TEMP%\_mei23562\cryptography-48.0.0.dist-info\licenses\license.bsd
%TEMP%\_mei23562\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
%TEMP%\_mei23562\cryptography-48.0.0.dist-info\sboms\sbom.json
%TEMP%\_mei23562\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei23562\libcrypto-3.dll
%TEMP%\_mei23562\libffi-8.dll
%TEMP%\_mei23562\libssl-3.dll
%TEMP%\_mei23562\psutil\_psutil_windows.pyd
%TEMP%\_mei23562\pyexpat.pyd
%TEMP%\_mei23562\python3.dll
%TEMP%\_mei23562\python313.dll
%TEMP%\_mei23562\pywin32_system32\pywintypes313.dll
%TEMP%\_mei23562\select.pyd
%TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
%TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
%TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
%TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
%TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
%TEMP%\_mei23562\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
%TEMP%\_mei23562\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei23562\sqlite3.dll
%TEMP%\_mei23562\unicodedata.pyd
%TEMP%\_mei23562\win32\win32api.pyd
%TEMP%\_mei23562\win32\win32clipboard.pyd
%TEMP%\_mei23562\win32\win32crypt.pyd
%TEMP%\_mei23562\win32\win32security.pyd
%TEMP%\cq32e2d1
%TEMP%\tmpy3axajil\1.exe
%TEMP%\tmp74yh_mq7\stealer.exe
%TEMP%\_mei50602\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_avif.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_imaging.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_imagingcms.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_imagingmath.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_imagingtk.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_webp.cp313-win_amd64.pyd
%TEMP%\_mei50602\pythonwin\mfc140u.dll
%TEMP%\_mei50602\pythonwin\win32ui.pyd
%TEMP%\_mei50602\vcruntime140.dll
%TEMP%\_mei50602\vcruntime140_1.dll
%TEMP%\_mei50602\_asyncio.pyd
%TEMP%\_mei50602\_bz2.pyd
%TEMP%\_mei50602\_cffi_backend.cp313-win_amd64.pyd
%TEMP%\_mei50602\_ctypes.pyd
%TEMP%\_mei50602\_decimal.pyd
%TEMP%\_mei50602\_elementtree.pyd
%TEMP%\_mei50602\_hashlib.pyd
%TEMP%\_mei50602\_lzma.pyd
%TEMP%\_mei50602\_multiprocessing.pyd
%TEMP%\_mei50602\_overlapped.pyd
%TEMP%\_mei50602\_queue.pyd
%TEMP%\_mei50602\_socket.pyd
%TEMP%\_mei50602\_sqlite3.pyd
%TEMP%\_mei50602\_ssl.pyd
%TEMP%\_mei50602\_wmi.pyd
%TEMP%\_mei50602\base_library.zip
%TEMP%\_mei50602\certifi\cacert.pem
%TEMP%\_mei50602\charset_normalizer\cd.cp313-win_amd64.pyd
%TEMP%\_mei50602\charset_normalizer\md.cp313-win_amd64.pyd
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\installer
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\metadata
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\record
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\wheel
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license.apache
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license.bsd
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\sboms\sbom.json
%TEMP%\_mei50602\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei50602\libcrypto-3.dll
%TEMP%\_mei50602\libffi-8.dll
%TEMP%\_mei50602\libssl-3.dll
%TEMP%\_mei50602\psutil\_psutil_windows.pyd
%TEMP%\_mei50602\pyexpat.pyd
%TEMP%\_mei50602\python3.dll
%TEMP%\_mei50602\python313.dll
%TEMP%\_mei50602\pywin32_system32\pythoncom313.dll
%TEMP%\_mei50602\pywin32_system32\pywintypes313.dll
%TEMP%\_mei50602\select.pyd
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
%TEMP%\_mei50602\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei50602\sqlite3.dll
%TEMP%\_mei50602\unicodedata.pyd
%TEMP%\_mei50602\win32\_win32sysloader.pyd
%TEMP%\_mei50602\win32\win32api.pyd
%TEMP%\_mei50602\win32\win32clipboard.pyd
%TEMP%\_mei50602\win32\win32crypt.pyd
%TEMP%\_mei50602\win32\win32event.pyd
%TEMP%\_mei50602\win32\win32security.pyd
%TEMP%\_mei50602\win32\win32trace.pyd
%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe
%WINDIR%\temp\__psscriptpolicytest_ckgs04i2.hpx.ps1
%WINDIR%\temp\__psscriptpolicytest_fze0l3es.nci.psm1
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-46-737.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-46-938.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-038.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-185.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-215.dump
%WINDIR%\temp\__psscriptpolicytest_gpbbf4ie.0ew.ps1
%WINDIR%\temp\__psscriptpolicytest_xlj1pe2v.jpz.psm1
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-368.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-384.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-437.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-686.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-789.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-874.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-966.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-47-997.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-018.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-036.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-068.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-083.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-115.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-500.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-553.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-585.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-616.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-638.dump
%WINDIR%\temp\content\1072-3540-powershell.exe-13-52-48-701.dump
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
%WINDIR%\temp\sejwafmrhmsx.sys

Deletes following files that it created itself

%TEMP%\_mei51162\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei51162\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei51162\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei51162\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei51162\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei51162\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei51162\base_library.zip
%TEMP%\_mei51162\crypto\cipher\_arc4.pyd
%TEMP%\_mei51162\crypto\cipher\_chacha20.pyd
%TEMP%\_mei51162\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_des.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei51162\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei51162\crypto\cipher\_salsa20.pyd
%TEMP%\_mei51162\crypto\hash\_blake2b.pyd
%TEMP%\_mei51162\crypto\hash\_blake2s.pyd
%TEMP%\_mei51162\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei51162\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei51162\crypto\hash\_keccak.pyd
%TEMP%\_mei51162\crypto\hash\_md2.pyd
%TEMP%\_mei51162\crypto\hash\_md4.pyd
%TEMP%\_mei51162\crypto\hash\_md5.pyd
%TEMP%\_mei51162\crypto\hash\_poly1305.pyd
%TEMP%\_mei51162\crypto\hash\_ripemd160.pyd
%TEMP%\_mei51162\crypto\hash\_sha1.pyd
%TEMP%\_mei51162\crypto\hash\_sha224.pyd
%TEMP%\_mei51162\crypto\hash\_sha256.pyd
%TEMP%\_mei51162\crypto\hash\_sha384.pyd
%TEMP%\_mei51162\crypto\hash\_sha512.pyd
%TEMP%\_mei51162\crypto\math\_modexp.pyd
%TEMP%\_mei51162\crypto\protocol\_scrypt.pyd
%TEMP%\_mei51162\crypto\publickey\_curve25519.pyd
%TEMP%\_mei51162\crypto\publickey\_curve448.pyd
%TEMP%\_mei51162\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei51162\crypto\publickey\_ed25519.pyd
%TEMP%\_mei51162\crypto\publickey\_ed448.pyd
%TEMP%\_mei51162\crypto\util\_cpuid_c.pyd
%TEMP%\_mei51162\crypto\util\_strxor.pyd
%TEMP%\_mei51162\libcrypto-3.dll
%TEMP%\_mei51162\libffi-8.dll
%TEMP%\_mei51162\libssl-3.dll
%TEMP%\_mei51162\pyexpat.pyd
%TEMP%\_mei51162\python314.dll
%TEMP%\_mei51162\select.pyd
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
%TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
%TEMP%\_mei51162\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei51162\ucrtbase.dll
%TEMP%\_mei51162\unicodedata.pyd
%TEMP%\_mei51162\vcruntime140.dll
%TEMP%\_mei51162\vcruntime140_1.dll
%TEMP%\_mei51162\_asyncio.pyd
%TEMP%\_mei51162\_bz2.pyd
%TEMP%\_mei51162\_cffi_backend.cp314-win_amd64.pyd
%TEMP%\_mei51162\_ctypes.pyd
%TEMP%\_mei51162\_decimal.pyd
%TEMP%\_mei51162\_hashlib.pyd
%TEMP%\_mei51162\_lzma.pyd
%TEMP%\_mei51162\_multiprocessing.pyd
%TEMP%\_mei51162\_overlapped.pyd
%TEMP%\_mei51162\_queue.pyd
%TEMP%\_mei51162\_socket.pyd
%TEMP%\_mei51162\_ssl.pyd
%TEMP%\_mei51162\_wmi.pyd
%TEMP%\_mei51162\_zstd.pyd
%TEMP%\gtgi5hld
%TEMP%\cq32e2d1
%TEMP%\_mei50602\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
%TEMP%\_mei50602\base_library.zip
%TEMP%\_mei50602\certifi\cacert.pem
%TEMP%\_mei50602\charset_normalizer\cd.cp313-win_amd64.pyd
%TEMP%\_mei50602\charset_normalizer\md.cp313-win_amd64.pyd
%TEMP%\_mei50602\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\installer
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license.apache
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\licenses\license.bsd
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\metadata
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\record
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\sboms\sbom.json
%TEMP%\_mei50602\cryptography-48.0.0.dist-info\wheel
%TEMP%\_mei50602\libcrypto-3.dll
%TEMP%\_mei50602\libffi-8.dll
%TEMP%\_mei50602\libssl-3.dll
%TEMP%\_mei50602\pil\_avif.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_imaging.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_imagingcms.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_imagingmath.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_imagingtk.cp313-win_amd64.pyd
%TEMP%\_mei50602\pil\_webp.cp313-win_amd64.pyd
%TEMP%\_mei50602\psutil\_psutil_windows.pyd
%TEMP%\_mei50602\pyexpat.pyd
%TEMP%\_mei50602\python3.dll
%TEMP%\_mei50602\python313.dll
%TEMP%\_mei50602\pythonwin\mfc140u.dll
%TEMP%\_mei50602\pythonwin\win32ui.pyd
%TEMP%\_mei50602\pywin32_system32\pythoncom313.dll
%TEMP%\_mei50602\pywin32_system32\pywintypes313.dll
%TEMP%\_mei50602\select.pyd
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
%TEMP%\_mei50602\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
%TEMP%\_mei50602\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei50602\sqlite3.dll
%TEMP%\_mei50602\unicodedata.pyd
%TEMP%\_mei50602\vcruntime140.dll
%TEMP%\_mei50602\vcruntime140_1.dll
%TEMP%\_mei50602\win32\win32api.pyd
%TEMP%\_mei50602\win32\win32clipboard.pyd
%TEMP%\_mei50602\win32\win32crypt.pyd
%TEMP%\_mei50602\win32\win32event.pyd
%TEMP%\_mei50602\win32\win32security.pyd
%TEMP%\_mei50602\win32\win32trace.pyd
%TEMP%\_mei50602\win32\_win32sysloader.pyd
%TEMP%\_mei50602\_asyncio.pyd
%TEMP%\_mei50602\_bz2.pyd
%TEMP%\_mei50602\_cffi_backend.cp313-win_amd64.pyd
%TEMP%\_mei50602\_ctypes.pyd
%TEMP%\_mei50602\_decimal.pyd
%TEMP%\_mei50602\_elementtree.pyd
%TEMP%\_mei50602\_hashlib.pyd
%TEMP%\_mei50602\_lzma.pyd
%TEMP%\_mei50602\_multiprocessing.pyd
%TEMP%\_mei50602\_overlapped.pyd
%TEMP%\_mei50602\_queue.pyd
%TEMP%\_mei50602\_socket.pyd
%TEMP%\_mei50602\_sqlite3.pyd
%TEMP%\_mei50602\_ssl.pyd
%TEMP%\_mei50602\_wmi.pyd
%WINDIR%\temp\__psscriptpolicytest_ckgs04i2.hpx.ps1
%WINDIR%\temp\__psscriptpolicytest_fze0l3es.nci.psm1
%WINDIR%\temp\__psscriptpolicytest_gpbbf4ie.0ew.ps1
%WINDIR%\temp\__psscriptpolicytest_xlj1pe2v.jpz.psm1

Network activity

Connects to

'po##.#ashvault.pro':443

TCP

Other

'po##.#ashvault.pro':443

UDP

DNS ASK po##.#ashvault.pro

Miscellaneous

Searches for the following windows

ClassName: 'Edit' WindowName: ''

Creates and executes the following

'<Current directory>\decrypted_temp.exe'
'%TEMP%\tmpq6edpd20\input.exe'
'%TEMP%\tmpe6ymv3be\cryptor.dll'
'%TEMP%\tmpy3axajil\1.exe'
'%TEMP%\tmp74yh_mq7\stealer.exe'
'%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe'

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\calc.exe'
'%ProgramFiles%\windowsapps\microsoft.windowscalculator_10.1906.55.0_x64__8wekyb3d8bbwe\calculator.exe' -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
'<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
'<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop UsoSvc
'<SYSTEM32>\sc.exe' stop WaaSMedicSvc
'<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop wuauserv
'<SYSTEM32>\sc.exe' stop bits
'<SYSTEM32>\sc.exe' stop dosvc
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
'<SYSTEM32>\dialer.exe'
'<SYSTEM32>\sc.exe' delete "NUXCTTKD"
'<SYSTEM32>\sc.exe' create "NUXCTTKD" binpath= "%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe" start= "auto"
'<SYSTEM32>\sc.exe' stop eventlog
'<SYSTEM32>\sc.exe' start "NUXCTTKD"
'<SYSTEM32>\calc.exe' ' (with hidden window)
'%TEMP%\tmpq6edpd20\input.exe' ' (with hidden window)
'%TEMP%\tmpe6ymv3be\cryptor.dll' ' (with hidden window)
'%TEMP%\tmpy3axajil\1.exe' ' (with hidden window)
'%TEMP%\tmp74yh_mq7\stealer.exe' ' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial