Trojan.MulDrop32.44322

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SystemUpdateService' = '"%APPDATA%\Microsoft\System\sysupdate.exe" --silent'

Modifies file system

Creates the following files

%TEMP%\_mei33442\sdl2.dll
%TEMP%\_mei33442\sdl2_image.dll
%TEMP%\_mei33442\sdl2_mixer.dll
%TEMP%\_mei33442\sdl2_ttf.dll
%TEMP%\_mei33442\vcruntime140.dll
%TEMP%\_mei33442\vcruntime140_1.dll
%TEMP%\_mei33442\_asyncio.pyd
%TEMP%\_mei33442\_bz2.pyd
%TEMP%\_mei33442\_cffi_backend.cp313-win_amd64.pyd
%TEMP%\_mei33442\_ctypes.pyd
%TEMP%\_mei33442\_decimal.pyd
%TEMP%\_mei33442\_hashlib.pyd
%TEMP%\_mei33442\_lzma.pyd
%TEMP%\_mei33442\_multiprocessing.pyd
%TEMP%\_mei33442\_overlapped.pyd
%TEMP%\_mei33442\_queue.pyd
%TEMP%\_mei33442\_socket.pyd
%TEMP%\_mei33442\_ssl.pyd
%TEMP%\_mei33442\_wmi.pyd
%TEMP%\_mei33442\base_library.zip
%TEMP%\_mei33442\cryptography-45.0.3.dist-info\installer
%TEMP%\_mei33442\cryptography-45.0.3.dist-info\metadata
%TEMP%\_mei33442\cryptography-45.0.3.dist-info\record
%TEMP%\_mei33442\cryptography-45.0.3.dist-info\wheel
%TEMP%\_mei33442\cryptography-45.0.3.dist-info\licenses\license
%TEMP%\_mei33442\cryptography-45.0.3.dist-info\licenses\license.apache
%TEMP%\_mei33442\cryptography-45.0.3.dist-info\licenses\license.bsd
%TEMP%\_mei33442\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei33442\freetype.dll
%TEMP%\_mei33442\libcrypto-3.dll
%TEMP%\_mei33442\libffi-8.dll
%TEMP%\_mei33442\libjpeg-9.dll
%TEMP%\_mei33442\libmodplug-1.dll
%TEMP%\_mei33442\libogg-0.dll
%TEMP%\_mei33442\libopus-0.dll
%TEMP%\_mei33442\libopusfile-0.dll
%TEMP%\_mei33442\libpng16-16.dll
%TEMP%\_mei33442\libssl-3.dll
%TEMP%\_mei33442\libtiff-5.dll
%TEMP%\_mei33442\libwebp-7.dll
%TEMP%\_mei33442\portmidi.dll
%TEMP%\_mei33442\psutil\_psutil_windows.pyd
%TEMP%\_mei33442\pyexpat.pyd
%TEMP%\_mei33442\pygame\sdl2.dll
%TEMP%\_mei33442\pygame\sdl2_image.dll
%TEMP%\_mei33442\pygame\sdl2_mixer.dll
%TEMP%\_mei33442\pygame\sdl2_ttf.dll
%TEMP%\_mei33442\pygame\_freetype.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\base.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\bufferproxy.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\color.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\constants.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\display.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\draw.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\event.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\font.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\freesansbold.ttf
%TEMP%\_mei33442\pygame\freetype.dll
%TEMP%\_mei33442\pygame\image.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\imageext.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\joystick.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\key.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\libjpeg-9.dll
%TEMP%\_mei33442\pygame\libogg-0.dll
%TEMP%\_mei33442\pygame\libopus-0.dll
%TEMP%\_mei33442\pygame\libpng16-16.dll
%TEMP%\_mei33442\pygame\mask.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\math.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\mixer.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\mixer_music.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\mouse.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\pixelarray.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\pixelcopy.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\pygame_icon.bmp
%TEMP%\_mei33442\pygame\rect.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\rwobject.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\scrap.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\surface.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\surflock.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\time.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\transform.cp313-win_amd64.pyd
%TEMP%\_mei33442\pygame\zlib1.dll
%TEMP%\_mei33442\python3.dll
%TEMP%\_mei33442\python313.dll
%TEMP%\_mei33442\pywin32_system32\pywintypes313.dll
%TEMP%\_mei33442\select.pyd
%TEMP%\_mei33442\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
%TEMP%\_mei33442\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
%TEMP%\_mei33442\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
%TEMP%\_mei33442\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
%TEMP%\_mei33442\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
%TEMP%\_mei33442\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
%TEMP%\_mei33442\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei33442\unicodedata.pyd
%TEMP%\_mei33442\win32\win32api.pyd
%TEMP%\_mei33442\win32\win32process.pyd
%TEMP%\_mei33442\win32\win32security.pyd
%TEMP%\_mei33442\zlib1.dll
%APPDATA%\ce850545\sys_1757665644.dat
%APPDATA%\microsoft\system\sysupdate.exe

Network activity

Connects to

'localhost':49692
'88.##8.163.195':1337

Miscellaneous

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c "ver"
'<SYSTEM32>\cmd.exe' /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdateService"
'<SYSTEM32>\reg.exe' query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdateService
'<SYSTEM32>\cmd.exe' /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdateService /t REG_SZ /d "\"%APPDATA%\Microsoft\System\sysupdate.exe\" --silent" /f"
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdateService /t REG_SZ /d "\"%APPDATA%\Microsoft\System\sysupdate.exe\" --silent" /f
'<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdateService"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdateService /t REG_SZ /d "\"%APPDATA%\Microsoft\System\sysupdate.exe\" --silent" /f"' (with hidden window)