| File name: | Rufus.exe |
| Full analysis: | https://app.any.run/tasks/b418eef0-a164-42c0-bb65-361f7f40dd88 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | November 17, 2024, 16:14:06 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections |
| MD5: | AF2CB43E6259155C910B7C177E6D4219 |
| SHA1: | 745668398FE47365589FCAF884D405261FEFF918 |
| SHA256: | 13CFADDC20DE282F987FDCA32A889BA1C07201D86C894BF2F5CDCAE3D09DBEED |
| SSDEEP: | 98304:aZJ3XNrYQ9Om9OLkYFbyoMrsUtCIq5dyy8kIfHNwq2ILCWfXBcVCiON3qFP9NsrN:F2gNwwb9Q |
MALICIOUS
Changes the Windows auto-update feature
- BZXOGD.exe (PID: 5592)
Connects to the CnC server
- Rufus.exe (PID: 6640)
LODA has been detected (SURICATA)
- Rufus.exe (PID: 6640)
SUSPICIOUS
Executable content was dropped or overwritten
- Rufus.exe (PID: 6640)
Reads security settings of Internet Explorer
- Rufus.exe (PID: 6640)
Executes as Windows Service
- vds.exe (PID: 6044)
Contacting a server suspected of hosting an CnC
- Rufus.exe (PID: 6640)
Connects to unusual port
- Rufus.exe (PID: 6640)
INFO
Reads mouse settings
- Rufus.exe (PID: 6640)
The process uses the downloaded file
- Rufus.exe (PID: 6640)
Create files in a temporary directory
- Rufus.exe (PID: 6640)
- BZXOGD.exe (PID: 5592)
Checks supported languages
- Rufus.exe (PID: 6640)
- BZXOGD.exe (PID: 5592)
Process checks computer location settings
- Rufus.exe (PID: 6640)
Reads the computer name
- Rufus.exe (PID: 6640)
- BZXOGD.exe (PID: 5592)
Sends debugging messages
- BZXOGD.exe (PID: 5592)
Process checks whether UAC notifications are on
- BZXOGD.exe (PID: 5592)
Reads the machine GUID from the registry
- BZXOGD.exe (PID: 5592)
The process uses AutoIt
- Rufus.exe (PID: 6640)
UPX packer has been detected
- BZXOGD.exe (PID: 5592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2012:01:29 21:32:28+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 526336 |
| InitializedDataSize: | 121856 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x165c1 |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 3.3.8.1 |
| ProductVersionNumber: | 3.3.8.1 |
| FileFlagsMask: | 0x0017 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Unknown |
| FileSubtype: | - |
| LanguageCode: | English (British) |
| CharacterSet: | Unicode |
| FileDescription: | - |
| FileVersion: | 3, 3, 8, 1 |
| CompiledScript: | AutoIt v3 Script: 3, 3, 8, 1 |
Total processes
139
Monitored processes
6
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2172 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5592 | "C:\Users\admin\AppData\Local\Temp\BZXOGD.exe" | C:\Users\admin\AppData\Local\Temp\BZXOGD.exe | Rufus.exe | ||||||||||||
User: admin Company: Akeo Consulting Integrity Level: HIGH Description: Rufus Version: 4.6.2208 Modules
| |||||||||||||||
| 6044 | C:\WINDOWS\System32\vds.exe | C:\Windows\System32\vds.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Virtual Disk Service Exit code: 258 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6256 | "C:\Users\admin\AppData\Local\Temp\BZXOGD.exe" | C:\Users\admin\AppData\Local\Temp\BZXOGD.exe | — | Rufus.exe | |||||||||||
User: admin Company: Akeo Consulting Integrity Level: MEDIUM Description: Rufus Exit code: 3221226540 Version: 4.6.2208 Modules
| |||||||||||||||
| 6640 | "C:\Users\admin\AppData\Local\Temp\Rufus.exe" | C:\Users\admin\AppData\Local\Temp\Rufus.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Version: 3, 3, 8, 1 Modules
| |||||||||||||||
| 6756 | C:\WINDOWS\System32\vdsldr.exe -Embedding | C:\Windows\System32\vdsldr.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Virtual Disk Service Loader Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
1 810
Read events
1 750
Write events
28
Delete events
32
Modification events
| (PID) Process: | (5592) BZXOGD.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4D995706-4648-4967-9EEE-491E86B4BC7A}Machine\Software\Policies\Microsoft\AppHVSI |
| Operation: | write | Name: | AllowAppHVSI_ProviderSet |
Value: 0 | |||
| (PID) Process: | (5592) BZXOGD.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4D995706-4648-4967-9EEE-491E86B4BC7A}Machine\Software\Policies\Microsoft\EdgeUpdate |
| Operation: | write | Name: | UpdateDefault |
Value: 0 | |||
| (PID) Process: | (5592) BZXOGD.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4D995706-4648-4967-9EEE-491E86B4BC7A}Machine\Software\Policies\Microsoft\Windows\Network Connections |
| Operation: | write | Name: | NC_DoNotShowLocalOnlyIcon |
Value: 1 | |||
| (PID) Process: | (5592) BZXOGD.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4D995706-4648-4967-9EEE-491E86B4BC7A}Machine\Software\Policies\Microsoft\Windows\Windows Feeds |
| Operation: | write | Name: | EnableFeeds |
Value: 0 | |||
| (PID) Process: | (5592) BZXOGD.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4D995706-4648-4967-9EEE-491E86B4BC7A}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate |
| Operation: | write | Name: | WUServer |
Value: http://neverupdatewindows10.com | |||
| (PID) Process: | (5592) BZXOGD.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4D995706-4648-4967-9EEE-491E86B4BC7A}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate |
| Operation: | write | Name: | WUStatusServer |
Value: http://neverupdatewindows10.com | |||
| (PID) Process: | (5592) BZXOGD.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4D995706-4648-4967-9EEE-491E86B4BC7A}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate |
| Operation: | write | Name: | UpdateServiceUrlAlternate |
Value: http://neverupdatewindows10.com | |||
| (PID) Process: | (5592) BZXOGD.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4D995706-4648-4967-9EEE-491E86B4BC7A}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate |
| Operation: | write | Name: | **del.FillEmptyContentUrls |
Value: | |||
| (PID) Process: | (5592) BZXOGD.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4D995706-4648-4967-9EEE-491E86B4BC7A}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
| Operation: | write | Name: | UseWUServer |
Value: 1 | |||
| (PID) Process: | (5592) BZXOGD.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{4D995706-4648-4967-9EEE-491E86B4BC7A}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
| Operation: | write | Name: | NoAutoUpdate |
Value: 0 | |||
Executable files
2
Suspicious files
1
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6640 | Rufus.exe | C:\Users\admin\AppData\Local\Temp\autB01F.tmp | executable | |
MD5:8FE64DA09AF371B02A31828415ECE8F3 | SHA256:8279696C1D78B14618500E9135886A3667B9DECC65946F3729002E4BFDBB20AB | |||
| 5592 | BZXOGD.exe | C:\Windows\System32\GroupPolicy\Machine\Registry.pol | binary | |
MD5:0C014C71A70DC7758BFDC822E974F1F3 | SHA256:8EBD915268E16B55A3ABDE6F612363576FAB5DF656F955D672CCE8889C5FF9CA | |||
| 6640 | Rufus.exe | C:\Users\admin\AppData\Local\Temp\BZXOGD.exe | executable | |
MD5:8FE64DA09AF371B02A31828415ECE8F3 | SHA256:8279696C1D78B14618500E9135886A3667B9DECC65946F3729002E4BFDBB20AB | |||
| 5592 | BZXOGD.exe | C:\Users\admin\AppData\Local\Temp\RufB9E3.tmp | text | |
MD5:903ACD7FECAB51ABB87835456159D49C | SHA256:BBB64F3615975E709A23577C867A6B563AD35CCFD8C7A4C7ABC5039B86B49E52 | |||
| 5592 | BZXOGD.exe | C:\Windows\System32\GroupPolicy\gpt.ini | text | |
MD5:3D89F23265C9E30A0CF055C3EB4D637C | SHA256:806582F6221C79BD4C7EACDC4B63E937CE247EEE2BA159F55C545CDFB2B1C25B | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
40
DNS requests
23
Threats
15
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.188:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.200.189.225:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2776 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4360 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
3700 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
5160 | SIHClient.exe | GET | 200 | 23.200.189.225:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5160 | SIHClient.exe | GET | 200 | 23.200.189.225:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6944 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5488 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.48.23.188:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.200.189.225:80 | www.microsoft.com | Moratelindo Internet Exchange Point | ID | whitelisted |
4360 | SearchApp.exe | 2.16.106.207:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
4360 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2172 | svchost.exe | 224.0.0.251:5353 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
th.bing.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
browser-pharmacy.gl.at.ply.gg |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Tunneling Service in DNS Lookup (* .ply .gg) |
— | — | Potentially Bad Traffic | ET INFO playit .gg Tunneling Domain in DNS Lookup |
13 ETPRO signatures available at the full report
Process | Message |
|---|---|
BZXOGD.exe | *** Rufus init ***
|
BZXOGD.exe | Cur dir: 'C:\Users\admin\AppData\Local\Temp\'
|
BZXOGD.exe | Dat dir: 'C:\Users\admin\AppData\Local'
|
BZXOGD.exe | Usr dir: 'C:\Users\admin'
|
BZXOGD.exe | Sys dir: 'C:\WINDOWS\system32'
|
BZXOGD.exe | App dir: 'C:\Users\admin\AppData\Local\Temp\'
|
BZXOGD.exe | Tmp dir: 'C:\Users\admin\AppData\Local\Temp\'
|
BZXOGD.exe | Will use settings from registry
|
BZXOGD.exe | Binary executable is signed by 'Akeo Consulting'
|
BZXOGD.exe | loc file not found in current directory - embedded one will be used
|