Technical Information
Triggers a user-defined sigma rule:
- d223b46b-5621-4037-88fe-fda32eead684
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\dllhost.exe
Modifies file system
Creates the following files
- %TEMP%\hrkrcfqk.dll
Moves itself
- from <Full path to file> to <Current directory>\azjfpzmpxl.exe
Network activity
Connects to
- 'pa###.##eatprovider.store':443
TCP
Other
- 'pa###.##eatprovider.store':443
UDP
- DNS ASK pa###.##eatprovider.store
Miscellaneous
Executes the following
- '<SYSTEM32>\dllhost.exe' /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
- '<SYSTEM32>\dllhost.exe' /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}' (with hidden window)
