Trojan.MulDrop33.30154

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\outlook cli manager update

Modifies file system

Creates the following files

<Current directory>\app_log.txt
%LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe

Network activity

TCP

Other

'15#.#01.65.91':443

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /C wmic bios get version
'<SYSTEM32>\wbem\wmic.exe' bios get version
'<SYSTEM32>\cmd.exe' /C sc query VBoxGuest
'<SYSTEM32>\sc.exe' query VBoxGuest
'<SYSTEM32>\cmd.exe' /C sc query VBoxMouse
'<SYSTEM32>\sc.exe' query VBoxMouse
'<SYSTEM32>\cmd.exe' /C sc query VBoxService
'<SYSTEM32>\sc.exe' query VBoxService
'<SYSTEM32>\cmd.exe' /C sc query vmdebug
'<SYSTEM32>\sc.exe' query vmdebug
'<SYSTEM32>\cmd.exe' /C sc query vmmouse
'<SYSTEM32>\sc.exe' query vmmouse
'<SYSTEM32>\cmd.exe' /C sc query VMTools
'<SYSTEM32>\sc.exe' query VMTools
'<SYSTEM32>\cmd.exe' /C sc query Vmware Physical Disk Helper Service
'<SYSTEM32>\sc.exe' query Vmware Physical Disk Helper Service
'<SYSTEM32>\cmd.exe' /C tasklist
'<SYSTEM32>\tasklist.exe'
'<SYSTEM32>\cmd.exe' /C wmic diskdrive get model
'<SYSTEM32>\wbem\wmic.exe' diskdrive get model
'<SYSTEM32>\cmd.exe' /C wmic logicaldisk where "DeviceID='C:'" get Size
'<SYSTEM32>\wbem\wmic.exe' logicaldisk where "DeviceID='C:'" get Size
'<SYSTEM32>\cmd.exe' /C wmic path win32_pointingdevice get name,description,manufacturer
'<SYSTEM32>\wbem\wmic.exe' path win32_pointingdevice get name,description,manufacturer
'<SYSTEM32>\cmd.exe' /C wmic cpu get numberofcores
'<SYSTEM32>\wbem\wmic.exe' cpu get numberofcores
'<SYSTEM32>\cmd.exe' /C wmic os get totalvisiblememorysize
'<SYSTEM32>\wbem\wmic.exe' os get totalvisiblememorysize
'<SYSTEM32>\cmd.exe' /C wmic cpu get name
'<SYSTEM32>\wbem\wmic.exe' cpu get name
'<SYSTEM32>\cmd.exe' /C wmic path win32_videocontroller get name
'<SYSTEM32>\wbem\wmic.exe' path win32_videocontroller get name
'<SYSTEM32>\cmd.exe' /C whoami
'<SYSTEM32>\whoami.exe'
'<SYSTEM32>\cmd.exe' /C schtasks /create /tn "Outlook CLI Manager Update" /tr "%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe" /sc ONLOGON /f
'<SYSTEM32>\schtasks.exe' /create /tn "Outlook CLI Manager Update" /tr "%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe" /sc ONLOGON /f
'<SYSTEM32>\cmd.exe' /C wmic bios get version' (with hidden window)
'<SYSTEM32>\cmd.exe' /C sc query VBoxGuest' (with hidden window)
'<SYSTEM32>\cmd.exe' /C sc query VBoxMouse' (with hidden window)
'<SYSTEM32>\cmd.exe' /C sc query VBoxService' (with hidden window)
'<SYSTEM32>\cmd.exe' /C sc query vmdebug' (with hidden window)
'<SYSTEM32>\cmd.exe' /C sc query vmmouse' (with hidden window)
'<SYSTEM32>\cmd.exe' /C sc query VMTools' (with hidden window)
'<SYSTEM32>\cmd.exe' /C sc query Vmware Physical Disk Helper Service' (with hidden window)
'<SYSTEM32>\cmd.exe' /C tasklist' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wmic diskdrive get model' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wmic logicaldisk where "DeviceID='C:'" get Size' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wmic path win32_pointingdevice get name,description,manufacturer' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wmic cpu get numberofcores' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wmic os get totalvisiblememorysize' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wmic cpu get name' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wmic path win32_videocontroller get name' (with hidden window)
'<SYSTEM32>\cmd.exe' /C whoami' (with hidden window)
'<SYSTEM32>\cmd.exe' /C schtasks /create /tn "Outlook CLI Manager Update" /tr "%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe" /sc ONLOGON /f' (with hidden window)