Windows Analysis Report
HomeDesk.msi

Overview

General Information

Sample name: HomeDesk.msi
Analysis ID: 1447353
MD5: 3e541108bd65df0d1127e15711da911a
SHA1: eb6ae2a6dd97fa670dcae50daef8444b3ae14cc1
SHA256: 52459bfa76a1b8918e1e18c7b35b9a5ea0c4876e7483e2f486217e3059b6c234
Tags: msi
Infos:

Detection

Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Detected unpacking (creates a PE file in dynamic memory)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for dropped file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Checks for available system drives (often done to infect USB drives)
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to launch a process as a different user
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Launches processes in debugging mode, may be used to hinder debugging
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Avira: detection malicious, Label: ADWARE/NotToTrack.dzcps
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll ReversingLabs: Detection: 21%
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe ReversingLabs: Detection: 58%
Multi AV Scanner detection for submitted file
Source: HomeDesk.msi ReversingLabs: Detection: 31%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 98.8% probability
Machine Learning detection for dropped file
Source: C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll Joe Sandbox ML: detected

Compliance
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Unpacked PE file: 5.2.LKdayanJELT9QDD900055.exe.400000.0.unpack
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: HomeDesk.msi
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028AE3A0 FindFirstFileW,FindClose, 3_2_028AE3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028ADDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 3_2_028ADDBC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 5_2_0040E3A0 FindFirstFileW,FindClose, 5_2_0040E3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 5_2_0040DDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 5_2_0040DDBC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C3E3A0 FindFirstFileW,FindClose, 8_2_02C3E3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C43CDA FindFirstFileW, 8_2_02C43CDA
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C3DDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 8_2_02C3DDBC
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /clientes/inspecionando.php HTTP/1.1Host: newsfoos.from-il.comCache-Control: no-cache
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /clientes/inspecionando.php HTTP/1.1Host: newsfoos.from-il.comCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: newsfoos.from-il.com
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.000000000064D000.00000004.00000020.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.0000000000697000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://newsfoos.from-il.com/clientes/inspecionando.php
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.0000000000697000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://newsfoos.from-il.com/clientes/inspecionando.php#
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.000000000064D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://newsfoos.from-il.com/clientes/inspecionando.php&
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.000000000064D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://newsfoos.from-il.com/clientes/inspecionando.phpN%
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.0000000000697000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://newsfoos.from-il.com/clientes/inspecionando.phpOI
Source: LKdayanJELT9QDD900055.exe, LKdayanJELT9QDD900055.exe, 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000002.2036285297.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000002.2038808113.000000007E290000.00000004.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000003.2032891929.000000007E640000.00000004.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000002.2039755447.000000007EC70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.indyproject.org/
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2906804901.0000000002D42000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pastebin.com/raw/v03rLptMes/inspecionando.php
Contains functionality for read data from the clipboard
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C448D2 OpenClipboard, 8_2_02C448D2
Contains functionality to modify clipboard data
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C4499A SetClipboardData, 8_2_02C4499A
Contains functionality to read the clipboard data
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C445E2 GetClipboardData, 8_2_02C445E2
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C446BA GetKeyboardState, 8_2_02C446BA

System Summary
barindex
PE file contains section with special chars
Source: AGLoader.dll.1.dr Static PE information: section name: .Lp&
Source: AGLoader.dll.1.dr Static PE information: section name: .l)4
Contains functionality to call native functions
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C444A2 NtdllDefWindowProc_W, 8_2_02C444A2
Contains functionality to launch a process as a different user
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00ECBD43 __EH_prolog3_GS,SetErrorMode,__set_abort_behavior,_memset,CreateProcessAsUserA,CreateProcessA, 3_2_00ECBD43
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C4458A ExitWindowsEx, 8_2_02C4458A
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\53da2f.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDD3D.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDDBB.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDDEA.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDF43.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE0BB.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{CD47C468-A902-4164-B360-5693BA87F9BC} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE168.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\53da32.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\53da32.msi Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSIDD3D.tmp Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDC0B4 3_2_00EDC0B4
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EE7105 3_2_00EE7105
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EF12DA 3_2_00EF12DA
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDB373 3_2_00EDB373
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDC4E9 3_2_00EDC4E9
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EF344A 3_2_00EF344A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00ED2672 3_2_00ED2672
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EE87DC 3_2_00EE87DC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00ED28C5 3_2_00ED28C5
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDB867 3_2_00EDB867
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EF184C 3_2_00EF184C
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00ED5A90 3_2_00ED5A90
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDEBDC 3_2_00EDEBDC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EE0B47 3_2_00EE0B47
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDBC7F 3_2_00EDBC7F
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EF0D68 3_2_00EF0D68
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EE2D1E 3_2_00EE2D1E
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EF1FF6 3_2_00EF1FF6
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDAFC9 3_2_00EDAFC9
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028AC3B8 3_2_028AC3B8
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 5_2_0040C3B8 5_2_0040C3B8
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C432BB 8_2_02C432BB
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C3C3B8 8_2_02C3C3B8
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe 7FA7499C7A72041D7D0FB1E4659466AD8D428080A176FA16276FD60ADC9DA0FD
Source: Joe Sandbox View Dropped File: C:\Windows\Installer\MSIDD3D.tmp 42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
Found potential string decryption / allocating functions
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: String function: 00EDDFB0 appears 53 times
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: String function: 00ED8F00 appears 60 times
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: String function: 00ED8F33 appears 41 times
PE file contains more sections than normal
Source: AGLoader.dll.1.dr Static PE information: Number of sections : 12 > 10
Sample file is different than original file name gathered from version info
Source: HomeDesk.msi Binary or memory string: OriginalFilenameAICustAct.dllF vs HomeDesk.msi
Source: classification engine Classification label: mal88.evad.winMSI@8/142@1/1
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C43BBA AdjustTokenPrivileges, 8_2_02C43BBA
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C43D5A GetDiskFreeSpaceW, 8_2_02C43D5A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00ECBED0 CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,Process32Next,CloseHandle, 3_2_00ECBED0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C44012 SizeofResource, 8_2_02C44012
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Microsoft\CMLE1C1.tmp Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Mutant created: \Sessions\1\BaseNamedObjects\My-Ecommece
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\TEMP\~DF66716DC87A4382C0.TMP Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Command line argument: >b 3_2_00EE6190
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: HomeDesk.msi ReversingLabs: Detection: 31%
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: JIS_C6229-1984-b-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: jp-ocr-b-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: jp-ocr-hand-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: JIS_C6229-1984-hand-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: ISO_6937-2-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: NATS-SEFI-ADD
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: NATS-DANO-ADD
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: NATS-SEFI-ADD
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: NATS-DANO-ADD
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: JIS_C6229-1984-b-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: jp-ocr-b-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: JIS_C6229-1984-hand-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: jp-ocr-hand-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: ISO_6937-2-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: JIS_C6229-1984-b-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: jp-ocr-b-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: jp-ocr-hand-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: JIS_C6229-1984-hand-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: ISO_6937-2-add
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: NATS-SEFI-ADD
Source: LKdayanJELT9QDD900055.exe String found in binary or memory: NATS-DANO-ADD
Source: unknown Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\HomeDesk.msi"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1B2D85995D295580A3E8CCFD73CF5DB1
Source: C:\Windows\System32\msiexec.exe Process created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"
Source: unknown Process created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"
Source: unknown Process created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1B2D85995D295580A3E8CCFD73CF5DB1 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe" Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.ui.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: inputhost.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.ui.immersive.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: agloader.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: security.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: idndl.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: magnification.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: agloader.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: security.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: agloader.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: security.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: HomeDesk.msi Static file information: File size 23561216 > 1048576
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: HomeDesk.msi

Data Obfuscation
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Unpacked PE file: 5.2.LKdayanJELT9QDD900055.exe.400000.0.unpack
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .l)4
PE file contains sections with non-standard names
Source: AGLoader.dll.1.dr Static PE information: section name: .didata
Source: AGLoader.dll.1.dr Static PE information: section name: .Lp&
Source: AGLoader.dll.1.dr Static PE information: section name: .LaQ
Source: AGLoader.dll.1.dr Static PE information: section name: .l)4
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDF974 push edi; ret 3_2_00EDF976
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDFA7F push esi; ret 3_2_00EDFA8F
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDFC68 push esi; ret 3_2_00EDFC6A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDFD51 push edi; ret 3_2_00EDFD53
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00ED8ECE push ecx; ret 3_2_00ED8EE1
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDDFF5 push ecx; ret 3_2_00EDE008
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028B0020 push ecx; mov dword ptr [esp], edx 3_2_028B0021
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028AF114 push ecx; mov dword ptr [esp], eax 3_2_028AF119
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028ABA24 push ecx; mov dword ptr [esp], edx 3_2_028ABA25
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028A6DF9 pushfd ; retf 3_2_028A6E03
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 5_2_00410020 push ecx; mov dword ptr [esp], edx 5_2_00410021
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 5_2_0040F114 push ecx; mov dword ptr [esp], eax 5_2_0040F119
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 5_2_0040BA24 push ecx; mov dword ptr [esp], edx 5_2_0040BA25
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 5_2_00406DF9 pushfd ; retf 5_2_00406E03
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C40020 push ecx; mov dword ptr [esp], edx 8_2_02C40021
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C35113 push ecx; ret 8_2_02C35114
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C3F114 push ecx; mov dword ptr [esp], eax 8_2_02C3F119
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C3178B push dword ptr [eax+1Ah]; ret 8_2_02C317BA
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C334D7 push esp; ret 8_2_02C334E5
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C33467 push dword ptr [edi+3Ah]; ret 8_2_02C3347E
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C42438 push ecx; mov dword ptr [esp], edx 8_2_02C42439
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C4256C push ecx; mov dword ptr [esp], ecx 8_2_02C42571
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C3BA24 push ecx; mov dword ptr [esp], edx 8_2_02C3BA25
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C34B5F push 33F86C61h; ret 8_2_02C34B64
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C31849 push ds; ret 8_2_02C3184A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C31851 push ds; ret 8_2_02C31852
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C31858 push ds; ret 8_2_02C3185A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C31839 push ds; ret 8_2_02C3183A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C439E8 push 10E40002h; ret 8_2_02C439ED
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C36DF9 pushfd ; retf 8_2_02C36E03
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDD3D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDDEA.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE0BB.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDDBB.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDF43.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDD3D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDDEA.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE0BB.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDDBB.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDF43.tmp Jump to dropped file
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Financeiro Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Financeiro Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 5C0005 value: E9 8B 2F 94 76 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 76F02F90 value: E9 7A D0 6B 89 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 5D0005 value: E9 2B BA 8F 76 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 76ECBA30 value: E9 DA 45 70 89 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 5E0008 value: E9 8B 8E 93 76 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 76F18E90 value: E9 80 71 6C 89 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 600005 value: E9 8B 4D 5F 75 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 75BF4D90 value: E9 7A B2 A0 8A Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 610005 value: E9 EB EB 5F 75 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 75C0EBF0 value: E9 1A 14 A0 8A Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 620005 value: E9 8B 8A 9B 74 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 74FD8A90 value: E9 7A 75 64 8B Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 630005 value: E9 2B 02 9D 74 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 2500 base: 75000230 value: E9 DA FD 62 8B Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: E20005 value: E9 8B 2F 0E 76 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: 76F02F90 value: E9 7A D0 F1 89 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: E30005 value: E9 2B BA 09 76 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: 76ECBA30 value: E9 DA 45 F6 89 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: E40008 value: E9 8B 8E 0D 76 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: 76F18E90 value: E9 80 71 F2 89 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: E70005 value: E9 8B 4D D8 74 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: 75BF4D90 value: E9 7A B2 27 8B Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: E80005 value: E9 EB EB D8 74 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: 75C0EBF0 value: E9 1A 14 27 8B Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: E90005 value: E9 8B 8A 14 74 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: 74FD8A90 value: E9 7A 75 EB 8B Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: EA0005 value: E9 2B 02 16 74 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 6524 base: 75000230 value: E9 DA FD E9 8B Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: A10005 value: E9 8B 2F 4F 76 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: 76F02F90 value: E9 7A D0 B0 89 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: A20005 value: E9 2B BA 4A 76 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: 76ECBA30 value: E9 DA 45 B5 89 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: A30008 value: E9 8B 8E 4E 76 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: 76F18E90 value: E9 80 71 B1 89 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: E70005 value: E9 8B 4D D8 74 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: 75BF4D90 value: E9 7A B2 27 8B Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: E80005 value: E9 EB EB D8 74 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: 75C0EBF0 value: E9 1A 14 27 8B Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: E90005 value: E9 8B 8A 14 74 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: 74FD8A90 value: E9 7A 75 EB 8B Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: EB0005 value: E9 2B 02 15 74 Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Memory written: PID: 4476 base: 75000230 value: E9 DA FD EA 8B Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C44832 IsIconic, 8_2_02C44832
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDAFC9 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_00EDAFC9
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00ECBED0 CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,Process32Next,CloseHandle, 3_2_00ECBED0
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Window / User API: foregroundWindowGot 361 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIDD3D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIDDEA.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIE0BB.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIDDBB.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIDF43.tmp Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API coverage: 7.9 %
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API coverage: 5.7 %
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API coverage: 2.5 %
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028AE3A0 FindFirstFileW,FindClose, 3_2_028AE3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028ADDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 3_2_028ADDBC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 5_2_0040E3A0 FindFirstFileW,FindClose, 5_2_0040E3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 5_2_0040DDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 5_2_0040DDBC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C3E3A0 FindFirstFileW,FindClose, 8_2_02C3E3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C43CDA FindFirstFileW, 8_2_02C43CDA
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C3DDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 8_2_02C3DDBC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028AFFB8 GetSystemInfo, 3_2_028AFFB8
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.000000000064D000.00000004.00000020.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.0000000000697000.00000004.00000020.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.00000000006B2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EE6408 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 3_2_00EE6408
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EE6408 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 3_2_00EE6408
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00ECBED0 CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,Process32Next,CloseHandle, 3_2_00ECBED0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDD605 GetProcessHeap, 3_2_00EDD605
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Windows\System32\msiexec.exe Process created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe" Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00ED07FC __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z,__EH_prolog3_catch,SetErrorMode,__set_abort_behavior,SetUnhandledExceptionFilter,__set_invalid_parameter_handler,__set_invalid_parameter_handler,__set_abort_behavior,_signal,_signal,_signal,_signal,_signal,_signal, 3_2_00ED07FC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDB285 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00EDB285
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDB254 SetUnhandledExceptionFilter, 3_2_00EDB254
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C44AEA keybd_event, 8_2_02C44AEA
Contains functionality to simulate mouse events
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C44AF2 mouse_event, 8_2_02C44AF2
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2906804901.0000000002D7C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROGRAM MANAGER
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2906804901.0000000002D7C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROGRAM MANAGER)
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2906804901.0000000002D7C000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Program ManagerVO
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDE4AA cpuid 3_2_00EDE4AA
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage, 3_2_00EEF0B3
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP, 3_2_00EEF1DD
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: GetLocaleInfoW,_GetPrimaryLen, 3_2_00EEF28A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s, 3_2_00EEF35E
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 3_2_00EED6C4
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW, 3_2_00EEEB0A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: GetLocaleInfoW, 3_2_00EDCC65
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: EnumSystemLocalesW, 3_2_00EDCC28
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: _GetPrimaryLen,EnumSystemLocalesW, 3_2_00EEEDBE
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: EnumSystemLocalesW, 3_2_00EEED7E
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage, 3_2_00EEEEBE
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: _GetPrimaryLen,EnumSystemLocalesW, 3_2_00EEEE3B
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: GetUserDefaultUILanguage,GetLocaleInfoW, 3_2_028AE4F4
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 3_2_028AD958
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: GetLocaleInfoW, 5_2_0042F000
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 5_2_0040D958
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: GetUserDefaultUILanguage,GetLocaleInfoW, 5_2_0040E4F4
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: EnumSystemLocalesW, 8_2_02C5F204
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: GetUserDefaultUILanguage,GetLocaleInfoW, 8_2_02C3E4F4
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_02C3D958
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: GetLocaleInfoW, 8_2_02C43D9A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: GetLocaleInfoW, 8_2_02C43DA2
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_00EDDE45 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 3_2_00EDDE45
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 8_2_02C43E9A GetTimeZoneInformation, 8_2_02C43E9A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe Code function: 3_2_028AFFCC GetVersion, 3_2_028AFFCC
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1447353 Sample: HomeDesk.msi Startdate: 24/05/2024 Architecture: WINDOWS Score: 88 33 newsfoos.from-il.com 2->33 37 Antivirus detection for dropped file 2->37 39 Multi AV Scanner detection for dropped file 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 4 other signatures 2->43 7 msiexec.exe 86 159 2->7         started        10 LKdayanJELT9QDD900055.exe 2->10         started        13 LKdayanJELT9QDD900055.exe 2->13         started        15 msiexec.exe 2 2->15         started        signatures3 process4 file5 23 C:\Windows\Installer\MSIE0BB.tmp, PE32 7->23 dropped 25 C:\Windows\Installer\MSIDF43.tmp, PE32 7->25 dropped 27 C:\Windows\Installer\MSIDDEA.tmp, PE32 7->27 dropped 29 4 other malicious files 7->29 dropped 17 LKdayanJELT9QDD900055.exe 1 20 7->17         started        21 msiexec.exe 7->21         started        45 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->45 signatures6 process7 dnsIp8 31 newsfoos.from-il.com 35.199.75.136, 49730, 80 GOOGLEUS United States 17->31 35 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 17->35 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
35.199.75.136
 newsfoos.from-il.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
newsfoos.from-il.com 35.199.75.136 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://newsfoos.from-il.com/clientes/inspecionando.php false
  • Avira URL Cloud: safe
 unknown