SHA256	37d82158e3ba555a339295e36b26b5f909427469d2694eb902fb2416c4824583
File Name	37d82158e3ba555a339295e36b26b5f909427469d2694eb902fb2416c4824583
File Type	Win32 EXE
Environment	Windows10
Analysis Start Time	2023-05-15 07:32:23 (UTC)
Analysis End Time	2023-05-15 07:37:58 (UTC)
Tags	Vidar Ransomware .xash Spyware Exe-Downloaded Trojan STOP

Static Analysis

MALICIOUS

Trulli

Network Analysis

MALICIOUS

Trulli

Dynamic Analysis

MALICIOUS

Trulli

File Analysis

NO THREATS

Trulli

Malicious
- Changes The Autorun Value In The Registry
  - 6956 - NSADGI~1.EXE
    - Persistence - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
    - Privilege Escalation - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- Modifying Access Control Lists For Files and Folders
  - 4552 - icacls "C:\Users\Administrator\AppData\Local\bd4c113a-6fd7-4e95-ae97-2702862bc30b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    - Defense Evasion - File and Directory Permissions Modification: Windows File and Directory Permissions Modification
- Task Scheduler Executable Triggered
  - 6868 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
  - 4184 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
  - 6500 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
- Task Scheduler Task Creation
  - 6868 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
  - 4184 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
  - 6500 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
Suspicious
- Sysmon Process Hollowing Detection
- Use Icacls to Hide File to Everyone
  - 4552 - icacls "C:\Users\Administrator\AppData\Local\bd4c113a-6fd7-4e95-ae97-2702862bc30b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    - Defense Evasion - Hide Artifacts: Hidden Files and Directories
- Suspicious Add Scheduled Task Parent
  - 6868 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
  - 4184 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
  - 6500 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
- Suspicious Schtasks From Env Var Folder
  - 6868 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
  - 4184 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
  - 6500 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
Info
- Creation of an Executable by an Executable
  - 6956 - NSADGI~1.EXE
    - Resource Development - Develop Capabilities: Malware
  - 4496 - NSADGI~1.EXE
    - Resource Development - Develop Capabilities: Malware
  - 4176 - build3.exe
    - Resource Development - Develop Capabilities: Malware
  - 4816 - NSADGI~1.EXE
    - Resource Development - Develop Capabilities: Malware
  - 5052 - build3.exe
    - Resource Development - Develop Capabilities: Malware
- Creates Files In The User Directory
  - 6956 - NSADGI~1.EXE
    - Collection - Data Staged: Local Data Staging
  - 4496 - NSADGI~1.EXE
    - Collection - Data Staged: Local Data Staging
  - 4176 - build3.exe
    - Collection - Data Staged: Local Data Staging
  - 4816 - NSADGI~1.EXE
    - Collection - Data Staged: Local Data Staging
  - 5052 - build3.exe
    - Collection - Data Staged: Local Data Staging
- Scheduled Task Creation
  - 6868 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
  - 4184 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task
  - 6500 - /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
    - Execution - Scheduled Task/Job: Scheduled Task
    - Persistence - Scheduled Task/Job: Scheduled Task
    - Privilege Escalation - Scheduled Task/Job: Scheduled Task

37d82158e3ba555a339295e36b26b5f909427469d2694eb902fb2416c4824583

7048 - [-130785.50s] DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
4912 - [-9.02s] Upfc.exe /launchtype periodic /cv JK0lgTuIl0C7R1ZYFD7Grg.0
- 6408 - [21.33s] sihclient.exe /cv JK0lgTuIl0C7R1ZYFD7Grg.0.2
4868 - [-9.01s] taskhostw.exe $(Arg0)
6164 - [-9.00s] taskhostw.exe Logon
6152 - [-8.99s] usoclient.exe StartScan
6180 - [-8.98s] rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
6192 - [-8.93s] taskhostw.exe None
4104 - [-8.92s] usoclient.exe StartScan
720 - [-8.90s] mstsca.exe
- 6500 - [-5.54s] C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
  - 6668 - [-5.47s] conhost.exe 0xffffffff -ForceV1
4808 - [0.0s] nsadgiuubsdeg.exe
- 6956 - [1.02s] nsadgiuubsdeg.exe
  - 4552 - [2.60s] icacls "C:\Users\Administrator\AppData\Local\bd4c113a-6fd7-4e95-ae97-2702862bc30b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  - 396 - [2.85s] nsadgiuubsdeg.exe --Admin IsNotAutoStart IsNotTask
    - 4496 - [3.52s] nsadgiuubsdeg.exe --Admin IsNotAutoStart IsNotTask
      - 5144 - [11.25s] build2.exe
        
        6212 - [12.16s] build2.exe
      - 4176 - [12.03s] build3.exe
        
        6868 - [12.07s] C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
        
        5176 - [12.08s] conhost.exe 0xffffffff -ForceV1
6924 - [16.68s] ApplicationFrameHost.exe -Embedding
6160 - [18.52s] svchost.exe -k LocalService -p -s BthAvctpSvc
5376 - [21.80s] nsadgiuubsdeg.exe
- 4368 - [22.42s] nsadgiuubsdeg.exe
  - 3304 - [23.95s] nsadgiuubsdeg.exe --Admin IsNotAutoStart IsNotTask
    - 4816 - [24.53s] nsadgiuubsdeg.exe --Admin IsNotAutoStart IsNotTask
      - 3332 - [32.02s] build2.exe
        
        2428 - [32.87s] build2.exe
      - 5052 - [33.18s] build3.exe
        
        4184 - [33.20s] C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"
        
        5844 - [33.21s] conhost.exe 0xffffffff -ForceV1

— DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

— Upfc.exe /launchtype periodic /cv JK0lgTuIl0C7R1ZYFD7Grg.0

— sihclient.exe /cv JK0lgTuIl0C7R1ZYFD7Grg.0.2

— taskhostw.exe $(Arg0)

— taskhostw.exe Logon

— usoclient.exe StartScan

— rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask

— taskhostw.exe None

— mstsca.exe

— C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe"

— conhost.exe 0xffffffff -ForceV1

— nsadgiuubsdeg.exe

— icacls "C:\Users\Administrator\AppData\Local\bd4c113a-6fd7-4e95-ae97-2702862bc30b" /deny *S-1-1-0:(OI)(CI)(DE,DC)

— nsadgiuubsdeg.exe --Admin IsNotAutoStart IsNotTask

— build2.exe

— build3.exe

— ApplicationFrameHost.exe -Embedding

— svchost.exe -k LocalService -p -s BthAvctpSvc

— C:\Users\Administrator\AppData\Local\bd4c113a-6fd7-4e95-ae97-2702862bc30b\NSADGI~1.EXE

— C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\AXN9OTQX\build2[1].exe

— C:\Users\Administrator\AppData\Local\aab0f6cb-bf64-46a0-9758-f7b592c4c245\build2.exe

— C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\AXN9OTQX\build3[1].exe

— C:\Users\Administrator\AppData\Local\aab0f6cb-bf64-46a0-9758-f7b592c4c245\build3.exe

— C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe

— C:\Users\Administrator\AppData\Local\6c841924-7ee3-4e1f-abfc-c68b6c2a5ea1\build2.exe

— C:\Users\Administrator\AppData\Local\6c841924-7ee3-4e1f-abfc-c68b6c2a5ea1\build3.exe

— C:\Windows\Logs\SIH\SIH.20230515.130230.376.1.etl

— HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL

— HKU\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates

— HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates

— HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates

— HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates

— HKU\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates

— HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates

— HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates

Registry	Value
HKU\S-1-5-21-2530950276-3298662170-1402498598-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper	"C:\Users\Administrator\AppData\Local\bd4c113a-6fd7-4e95-ae97-2702862bc30b\NSADGI~1.EXE" --AutoStart

Type	Indicator	Reputation
IP Address	109[.]98[.]58[.]98	Malicious
IP Address	187[.]212[.]183[.]201	Malicious
IP Address	190[.]229[.]19[.]7	Malicious
IP Address	116[.]202[.]1[.]79	Malicious
IP Address	162[.]0[.]217[.]254	Malicious
Domain	zexeq[.]com	Malicious
Domain	colisumy[.]com	Malicious
Domain	t[.]me	Malicious
URL	hxxp://zexeq[.]com/test1/get[.]php?pid=*&first=*	Malicious
URL	hxxp://colisumy[.]com/dl/build2[.]exe	Malicious
URL	hxxp://zexeq[.]com/files/1/build3[.]exe	Malicious
URL	hxxp://116[.]202[.]1[.]79/recent[.]zip	Malicious
Sha256	6e6061cd2d846e6be7058e35b0dab7f0513038a410a367be304e2e71c0bfb427	Anomalous Activity
Sha256	8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0	Anomalous Activity

Method	URL	IP	HTTP Status
GET	hxxp://116[.]202[.]1[.]79/recent[.]zip	116[.]202[.]1[.]79	200
GET	hxxp://colisumy[.]com/dl/build2[.]exe	190[.]229[.]19[.]7	200
POST	hxxp://116[.]202[.]1[.]79/	116[.]202[.]1[.]79	200
GET	hxxp://zexeq[.]com/files/1/build3[.]exe	109[.]98[.]58[.]98	200
GET	hxxp://zexeq[.]com/test1/get[.]php?pid=*&first=*	109[.]98[.]58[.]98	200
GET	hxxp://116[.]202[.]1[.]79/ef32d425b907146eeb9090dbc9455ab1	116[.]202[.]1[.]79	200

Domain	IP
t[.]me	149[.]154[.]167[.]99
api[.]2ip[.]ua	162[.]0[.]217[.]254
zexeq[.]com	109[.]98[.]58[.]98 187[.]212[.]183[.]201
colisumy[.]com	190[.]229[.]19[.]7
r[.]bing[.]com	184[.]84[.]233[.]235
56[.]126[.]166[.]20[.]in-addr[.]arpa	SECNEURX_DNS

JA3S	Domain
61be9ce3d068c08ff99a857f62352f9d	api[.]2ip[.]ua
098e26e2609212ac1bfac552fbe04127	t[.]me
c8d5b17a0fd5b4ee799ca8bd692fee69	r[.]bing[.]com

Sha256	FileType
ca5837c6b4cdde0e3ef9942ba308ca19e9b51439048bd0c2fcf5753e1403a517	application/zip
6e6061cd2d846e6be7058e35b0dab7f0513038a410a367be304e2e71c0bfb427	application/x-dosexec
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df	text/plain
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0	application/x-dosexec
bae26690f6055fd2835ace4e17889612e1a3ec9ec23ebfd5b6d2951deda68e99	text/plain
700d81b4d0fb4beefdb51236732a1448a824396293587f9ce873a0f8894ba184	text/plain

Connections	IP
UDP	162[.]159[.]36[.]2
TCP	184[.]84[.]233[.]235 149[.]154[.]167[.]99 162[.]0[.]217[.]254 109[.]98[.]58[.]98 116[.]202[.]1[.]79 190[.]229[.]19[.]7

× ❮❯