Analysis Report $RDPLVFM.exe

Overview

General Information

Sample Name: $RDPLVFM.exe
Analysis ID: 392874
MD5: 9cbcd1d8dae34cd6cc49460103e521c4
SHA1: b07e7b15752e1e25dd1e9fd480cacd5f3a79c5de
SHA256: a9497a467b5846d60f2c12a3fd03c4fce70e38a7237a916d93ee440048b9c59b
Infos:

Most interesting Screenshot:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Binary is likely a compiled AutoIt script file
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains strange resources
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sleep loop found (likely to delay execution)
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: $RDPLVFM.exe Virustotal: Detection: 11% Perma Link
Source: $RDPLVFM.exe Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: wextract.pdb source: $RDPLVFM.exe
Source: Binary string: wextract.pdbGCTL source: $RDPLVFM.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00405FB7 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW, 2_2_00405FB7
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00407D3F FindFirstFileW, 2_2_00407D3F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\AppData\Local\Temp\IXP000.TMP\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\AppData\Local\Temp\IXP000.TMP\lang.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\ Jump to behavior
Source: status.php.2.dr String found in binary or memory: http://192.168.0.100/
Source: crypt.php.2.dr String found in binary or memory: http://aspirine.org/htpasswd_en.html
Source: libcurl.so.4.2.dr String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: documentation.php.2.dr String found in binary or memory: http://docs.allnetnetworks.com/
Source: documentation.php.2.dr String found in binary or memory: http://docs.allnetnetworks.com/check.php
Source: documentation.php.2.dr String found in binary or memory: http://docs.allnetnetworks.com/direct.php
Source: crypt.php.2.dr String found in binary or memory: http://httpd.apache.org/docs/2.2/misc/password_encryptions.html
Source: jquery-ui-1.11.4.custom.min.css.2.dr String found in binary or memory: http://jqueryui.com
Source: jquery-ui-1.11.4.custom.min.css.2.dr String found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Arial%2C%20Helvetica%2C%20sans-serif&fwDefault=normal&fsD
Source: jquery.blockUI.min.js.2.dr String found in binary or memory: http://malsup.com/jquery/block/
Source: 7za.exe, 00000002.00000003.645520903.00000000007C0000.00000004.00000001.sdmp String found in binary or memory: http://openweathermap.org/
Source: crypt.php.2.dr String found in binary or memory: http://svn.apache.org/viewvc/apr/apr-util/branches/1.3.x/crypto/apr_md5.c?view=co
Source: jquery.timepicker.min.js.2.dr String found in binary or memory: http://trentrichardson.com/examples/timepicker
Source: jquery.simplecolorpicker.css.2.dr String found in binary or memory: http://twitter.github.com/bootstrap/assets/css/bootstrap.css
Source: test_connection.sh.2.dr String found in binary or memory: http://www.allnet.de
Source: about.html.2.dr String found in binary or memory: http://www.allnet.de/gpl.html
Source: alp.exe, 00000006.00000000.648836045.0000000000FB4000.00000002.00020000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/R
Source: crypt.php.2.dr String found in binary or memory: http://www.cryptologie.net/article/126/bruteforce-apr1-hashes/
Source: openssl.cnf.2.dr String found in binary or memory: http://www.domain.dom/ca-crl.pem
Source: jquery.download.js.2.dr String found in binary or memory: http://www.filamentgroup.com
Source: jquery.download.js.2.dr String found in binary or memory: http://www.filamentgroup.com/lab/jquery_plugin_for_requesting_ajax_like_file_downloads/
Source: about.html.2.dr String found in binary or memory: http://www.flotcharts.org/
Source: jquery-ui.icon-font.css.2.dr, jquery.blockUI.min.js.2.dr String found in binary or memory: http://www.gnu.org/licenses/gpl.html
Source: test_connection.sh.2.dr String found in binary or memory: http://www.google.de
Source: access_log.conf.2.dr String found in binary or memory: http://www.lighttpd.net/documentation/access.html
Source: jquery.blockUI.min.js.2.dr String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: libcrypto.so.2.dr String found in binary or memory: http://www.openssl.org/support/faq.html
Source: libcrypto.so.2.dr String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: crypt.php.2.dr String found in binary or memory: http://www.php.net/manual/en/function.crypt.php#73619
Source: jquery.short_cuts.js.2.dr String found in binary or memory: http://www.stepanreznikov.com/js-shortcuts/
Source: lang_fr.ini.2.dr String found in binary or memory: http://www.wetter.com/wetter_rss/wetter.xml)
Source: 7za.exe, 00000002.00000003.645520903.00000000007C0000.00000004.00000001.sdmp, jsonswitch.php.2.dr String found in binary or memory: https://192.168.1.19/xml/jsonswitch.php?id=168&set=8.8&fading=16.9
Source: jquery-ui.icon-font.css.2.dr String found in binary or memory: https://creativecommons.org/licenses/by-sa/3.0/
Source: about.html.2.dr String found in binary or memory: https://github.com/HanSolo/SteelSeries-Canvas/
Source: about.html.2.dr String found in binary or memory: https://github.com/flot/flot/blob/master/LICENSE.txt
Source: jquery.simplecolorpicker.css.2.dr String found in binary or memory: https://github.com/twitter/bootstrap/blob/master/less/dropdowns.less
Source: crypt.php.2.dr String found in binary or memory: https://github.com/whitehat101/apr1-md5
Source: ca-certificates.crt.2.dr String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/cert
Source: about.html.2.dr String found in binary or memory: https://jquery.com/
Source: about.html.2.dr String found in binary or memory: https://jquery.org/license/
Source: about.html.2.dr String found in binary or memory: https://plus.google.com/105784522827877256999
Source: checkupdate.sh.2.dr String found in binary or memory: https://update.allnet.de/
Source: offlineupdate.sh.2.dr String found in binary or memory: https://update.allnet.de/v3/

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: 7za.exe, 00000002.00000002.646626684.00000000007DA000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\patchfiles\www\db\chip\index.php, type: DROPPED Matched rule: Web Shell - file phpshell3.php Author: Florian Roth
Binary is likely a compiled AutoIt script file
Source: alp.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: alp.exe, 00000006.00000000.648738365.0000000000F9E000.00000002.00020000.sdmp String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_004084D7: DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW, 2_2_004084D7
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00468500 2_2_00468500
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_004559DF 2_2_004559DF
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0041B079 2_2_0041B079
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0045B5AB 2_2_0045B5AB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00488250 2_2_00488250
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0046C350 2_2_0046C350
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00478490 2_2_00478490
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_004785A0 2_2_004785A0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_004089A6 2_2_004089A6
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0043CAE1 2_2_0043CAE1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0047CD68 2_2_0047CD68
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00404E85 2_2_00404E85
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0044D018 2_2_0044D018
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0048D0D3 2_2_0048D0D3
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00445081 2_2_00445081
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_004750A0 2_2_004750A0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0048D261 2_2_0048D261
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00481290 2_2_00481290
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0048D33B 2_2_0048D33B
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0048D421 2_2_0048D421
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0047D4D0 2_2_0047D4D0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_004015C8 2_2_004015C8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_004019BD 2_2_004019BD
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00471A00 2_2_00471A00
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00475C80 2_2_00475C80
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00471D10 2_2_00471D10
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00475D80 2_2_00475D80
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00469EC0 2_2_00469EC0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0047DE90 2_2_0047DE90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00465FE0 2_2_00465FE0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_004221D5 2_2_004221D5
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_004721A0 2_2_004721A0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0045E376 2_2_0045E376
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0044E32B 2_2_0044E32B
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00486460 2_2_00486460
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F1B043 6_2_00F1B043
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F2410F 6_2_00F2410F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F03200 6_2_00F03200
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F24BEF 6_2_00F24BEF
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00EFE3B0 6_2_00EFE3B0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00EF9B60 6_2_00EF9B60
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F0F563 6_2_00F0F563
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F19ED0 6_2_00F19ED0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00EF77B0 6_2_00EF77B0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00EF6F07 6_2_00EF6F07
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: String function: 00401CEB appears 121 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: String function: 0048C9C0 appears 430 times
PE file contains executable resources (Code or Archives)
Source: $RDPLVFM.exe Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, 7557622 bytes, 9 files
PE file contains strange resources
Source: $RDPLVFM.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: $RDPLVFM.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: $RDPLVFM.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: alp.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: alp.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: alp.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: alp.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: alp.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: alp.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: $RDPLVFM.exe, 00000000.00000003.638525072.000002368D6D1000.00000004.00000001.sdmp Binary or memory string: OriginalFilename7za.exe, vs $RDPLVFM.exe
Source: $RDPLVFM.exe Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs $RDPLVFM.exe
Source: $RDPLVFM.exe Binary or memory string: OriginalFilenameWEXTRACT.EXE D vs $RDPLVFM.exe
Yara signature match
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\patchfiles\www\db\config\ajax.php, type: DROPPED Matched rule: webshell_php_generic_tiny date = 2021/01/14, author = Arnim Rupp, description = php webshell having some kind of input and some kind of payload. restricted to small files or would give lots of false positives, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\patchfiles\www\db\chip\dataupd.php, type: DROPPED Matched rule: webshell_php_generic_tiny date = 2021/01/14, author = Arnim Rupp, description = php webshell having some kind of input and some kind of payload. restricted to small files or would give lots of false positives, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\patchfiles\www\ajax\logfile.php, type: DROPPED Matched rule: webshell_php_generic_tiny date = 2021/01/14, author = Arnim Rupp, description = php webshell having some kind of input and some kind of payload. restricted to small files or would give lots of false positives, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\patchfiles\www\db\chip\index.php, type: DROPPED Matched rule: webshell_phpshell3 date = 2014/01/28, author = Florian Roth, description = Web Shell - file phpshell3.php, score = 76117b2ee4a7ac06832d50b2d04070b8
Source: classification engine Classification label: mal60.winEXE@7/561@0/0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F3CE7A GetLastError,FormatMessageW, 6_2_00F3CE7A
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00408598 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification, 2_2_00408598
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0041A004 __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 2_2_0041A004
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_004084D7 DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW, 2_2_004084D7
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F36532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle, 6_2_00F36532
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00EF406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 6_2_00EF406B
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2804:120:WilError_01
Source: C:\Users\user\Desktop\$RDPLVFM.exe File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP Jump to behavior
Source: $RDPLVFM.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File read: C:\Users\user\AppData\Local\Temp\IXP000.TMP\lang.ini Jump to behavior
Source: C:\Users\user\Desktop\$RDPLVFM.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Windows\system32\advpack.dll,DelNodeRunDLL32 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\'
Source: sqldb_write.2.dr Binary or memory string: SELECT value FROM config WHERE tag='%s';%sINSERT INTO config (tag,value) values ('%s','%s');UPDATE config SET value='%s' where tag='%s';Y@@?
Source: timer_demon.2.dr Binary or memory string: INSERT INTO config (tag,value) values ('%s','%s');UPDATE config SET value='%s' where tag='%s';%4.2f%ld*** SQLDB_READ_STRING ERROR: LOCKED ! SQL="%s" ***
Source: sqldb_write.2.dr Binary or memory string: SELECT value FROM config WHERE tag='%s';
Source: restore.sql.2.dr Binary or memory string: INSERT or REPLACE INTO frontend select * from merge.frontend;
Source: i2c_demon.2.dr Binary or memory string: CREATE TABLE [i2c_new] ([id] INTEGER NOT NULL PRIMARY KEY, [chip_number] INTEGER NOT NULL DEFAULT '0',[chip_address] INTEGER NOT NULL DEFAULT '0',[i2c_bus] INTEGER NOT NULL DEFAULT '0',[i2c_group] INTEGER NOT NULL DEFAULT '0',[i2c_port] INTEGER NOT NULL DEFAULT '0',[i2c_mux_enabled] INTEGER NOT NULL DEFAULT '0',[i2c_mux_port] INTEGER NOT NULL DEFAULT '0',[timestamp] TEXT NOT NULL DEFAULT '00000000', [comment] TEXT default '');
Source: restore.sql.2.dr Binary or memory string: INSERT or REPLACE INTO sensors_logical select * from merge.sensors_logical;
Source: restore.sql.2.dr Binary or memory string: INSERT or REPLACE INTO timer select * from merge.timer;
Source: update_demon.2.dr Binary or memory string: INSERT INTO config (tag,value) values ('%s','%s');UPDATE config SET value='%s' where tag='%s';%4.2f/etc/allnetenv/config.s3db*** SQLDB_READ_STRING ERROR: LOCKED ! SQL="%s" ***
Source: restore.sql.2.dr Binary or memory string: INSERT or REPLACE INTO users select * from merge.users;
Source: sqldb_write.2.dr Binary or memory string: UPDATE config SET value='%s' where tag='%s';
Source: sqldb_write.2.dr Binary or memory string: INSERT INTO config (tag,value) values ('%s','%s');
Source: i2c_demon.2.dr Binary or memory string: INSERT INTO config (tag,value) values ('%s','%s');UPDATE config SET value='%s' where tag='%s';%4.2f*** SQLDB_READ_STRING ERROR: LOCKED ! SQL="%s" ***
Source: restore.sql.2.dr Binary or memory string: INSERT or REPLACE INTO external select * from merge.external;
Source: i2c_demon.2.dr Binary or memory string: CREATE TABLE [i2c_all] ([id] INTEGER NOT NULL PRIMARY KEY, [chip_number] INTEGER NOT NULL DEFAULT '0',[chip_address] INTEGER NOT NULL DEFAULT '0',[i2c_bus] INTEGER NOT NULL DEFAULT '0',[i2c_group] INTEGER NOT NULL DEFAULT '0',[i2c_port] INTEGER NOT NULL DEFAULT '0',[i2c_mux_enabled] INTEGER NOT NULL DEFAULT '0',[i2c_mux_port] INTEGER NOT NULL DEFAULT '0',[external_dbid] INTEGER NOT NULL DEFAULT '0',[timestamp] TEXT NOT NULL DEFAULT '00000000', [comment] TEXT default '');
Source: query_resetbutton.2.dr Binary or memory string: INSERT INTO config (tag,value) values ('%s','%s');UPDATE config SET value='%s' where tag='%s';%4.2f%ld/etc/allnetenv/config.s3db*** SQLDB_READ_STRING ERROR: LOCKED ! SQL="%s" ***
Source: restore.sql.2.dr Binary or memory string: INSERT or REPLACE INTO mapping select * from merge.mapping;
Source: restore.sql.2.dr Binary or memory string: INSERT or REPLACE INTO config select * from merge.config;
Source: restore.sql.2.dr Binary or memory string: INSERT or REPLACE INTO camera_upload select * from merge.camera_upload;
Source: restore.sql.2.dr Binary or memory string: INSERT or REPLACE INTO matrix select * from merge.matrix;
Source: $RDPLVFM.exe Virustotal: Detection: 11%
Source: unknown Process created: C:\Users\user\Desktop\$RDPLVFM.exe 'C:\Users\user\Desktop\$RDPLVFM.exe'
Source: C:\Users\user\Desktop\$RDPLVFM.exe Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe x -y patchfiles.zip
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\$RDPLVFM.exe Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Windows\system32\advpack.dll,DelNodeRunDLL32 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\'
Source: C:\Users\user\Desktop\$RDPLVFM.exe Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe x -y patchfiles.zip Jump to behavior
Source: C:\Users\user\Desktop\$RDPLVFM.exe Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Jump to behavior
Source: C:\Users\user\Desktop\$RDPLVFM.exe File written: C:\Users\user\AppData\Local\Temp\IXP000.TMP\lang.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Window found: window name: SysTabControl32 Jump to behavior
Source: $RDPLVFM.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: $RDPLVFM.exe Static file information: File size 7715840 > 1048576
Source: $RDPLVFM.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x751400
Source: $RDPLVFM.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: $RDPLVFM.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: $RDPLVFM.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: $RDPLVFM.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: $RDPLVFM.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: $RDPLVFM.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: $RDPLVFM.exe Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: $RDPLVFM.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wextract.pdb source: $RDPLVFM.exe
Source: Binary string: wextract.pdbGCTL source: $RDPLVFM.exe
Source: $RDPLVFM.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: $RDPLVFM.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: $RDPLVFM.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: $RDPLVFM.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: $RDPLVFM.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

barindex
Binary contains a suspicious time stamp
Source: $RDPLVFM.exe Static PE information: 0xE68AAE13 [Fri Jul 25 18:16:51 2092 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F23920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW, 6_2_00F23920
PE file contains an invalid checksum
Source: alp.exe.0.dr Static PE information: real checksum: 0xf38fa should be: 0xfdcb3
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0048C9C0 push eax; ret 2_2_0048C9DE
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_0048CD70 push eax; ret 2_2_0048CD9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F16B05 push ecx; ret 6_2_00F16B18

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\$RDPLVFM.exe File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\plink.exe Jump to dropped file
Source: C:\Users\user\Desktop\$RDPLVFM.exe File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\pscp.exe Jump to dropped file
Source: C:\Users\user\Desktop\$RDPLVFM.exe File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Jump to dropped file
Source: C:\Users\user\Desktop\$RDPLVFM.exe File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Jump to dropped file
Source: C:\Users\user\Desktop\$RDPLVFM.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\Desktop\$RDPLVFM.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\Desktop\$RDPLVFM.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\Desktop\$RDPLVFM.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Window / User API: threadDelayed 9998 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Window / User API: foregroundWindowGot 500 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Window / User API: foregroundWindowGot 1274 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\$RDPLVFM.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\plink.exe Jump to dropped file
Source: C:\Users\user\Desktop\$RDPLVFM.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\pscp.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe TID: 6748 Thread sleep time: -99980s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Last function: Thread delayed
Sleep loop found (likely to delay execution)
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Thread sleep count: Count: 9998 delay: -10 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00405FB7 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW, 2_2_00405FB7
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00407D3F FindFirstFileW, 2_2_00407D3F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\7za.exe Code function: 2_2_00408D40 GetSystemInfo, 2_2_00408D40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\AppData\Local\Temp\IXP000.TMP\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\AppData\Local\Temp\IXP000.TMP\lang.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe File opened: C:\Users\user\ Jump to behavior

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F23920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW, 6_2_00F23920
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F23920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW, 6_2_00F23920
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F23920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW, 6_2_00F23920
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F26F40 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, 6_2_00F26F40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\alp.exe Code function: 6_2_00F181AC SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00F181AC
Source: $RDPLVFM.exe, 00000000.00000002.1160682065.000002368DB40000.00000002.00000001.sdmp, alp.exe, 00000006.00000002.1162446635.0000000001FD0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: $RDPLVFM.exe, 00000000.00000002.1160682065.000002368DB40000.00000002.00000001.sdmp, alp.exe, 00000006.00000002.1162446635.0000000001FD0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: $RDPLVFM.exe, 00000000.00000002.1160682065.000002368DB40000.00000002.00000001.sdmp, alp.exe, 00000006.00000002.1162446635.0000000001FD0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: alp.exe, 00000006.00000000.648738365.0000000000F9E000.00000002.00020000.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
Source: $RDPLVFM.exe, 00000000.00000002.1160682065.000002368DB40000.00000002.00000001.sdmp, alp.exe, 00000006.00000002.1162446635.0000000001FD0000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: C:\Users\user\Desktop\$RDPLVFM.exe Code function: 0_2_00007FF63C4B80F0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter, 0_2_00007FF63C4B80F0
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 392874 Sample: $RDPLVFM.exe Startdate: 19/04/2021 Architecture: WINDOWS Score: 60 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Binary is likely a compiled AutoIt script file 2->39 7 $RDPLVFM.exe 1 11 2->7         started        10 rundll32.exe 2->10         started        process3 file4 19 C:\Users\user\AppData\Local\Temp\...\alp.exe, PE32 7->19 dropped 21 C:\Users\user\AppData\Local\Temp\...\pscp.exe, PE32 7->21 dropped 23 C:\Users\user\AppData\Local\...\plink.exe, PE32 7->23 dropped 25 C:\Users\user\AppData\Local\Temp\...\7za.exe, PE32 7->25 dropped 12 7za.exe 502 7->12         started        15 alp.exe 7->15         started        process5 file6 27 C:\Users\user\AppData\Local\Temp\...\lighttpd, ELF 12->27 dropped 29 C:\Users\user\AppData\Local\...\update_demon, ELF 12->29 dropped 31 C:\Users\user\AppData\Local\...\timer_demon, ELF 12->31 dropped 33 112 other files (none is malicious) 12->33 dropped 17 conhost.exe 12->17         started        process7
No contacted IP infos